Hacker News Reader

Comment by pvinis | Hacker News Reader

Yes we know. brew tells you that. And you can disable it. Data is being sent to Google everytime you do almost anything in almost all websites, using the same technology. So what?

Some of the times it's to make the product better, or better targeted. Some other times it's just for spying on the users.

Let's stop complaining about stuff that someone does and tell you they do it. There are many more that do the same things without telling you.

Furthermore, now that you know, for brew specifically, will you opt out? Is your brew command history so secret that you care more about noone looking at it than helping making brew better? Chances are you use brew quite often. Chances are brew is not perfect. Will you choose to make its progress slower because of no real security reason?

How do we expect open source to become better if everyone is being a crybaby because brew got a history of how often they do brew update?

View on HN

The US approach to privacy is "let the market sort it out". It has sorted it out by transforming the internet into a giant spying machine sucking up contacts, photos, documents, videos, metadata, what packages you use, when where and how you exercise, everything

The EU approach to privacy (eroded by lobbying and lack of control over US companies) is that citizens have a right over their information. They can ask what personal information a company has on them, ask that it be corrected or deleted. This has resulted in companies that are more careful with data.

Whenever I read a post like yours I immediately think of so-called "useful innocents", to put it euphemistically [1]. Fighting for a non-goal of better open source through analytics (get real), corporate dominance and fewer rights for individuals.

Companies don't need analytics to improve software. They certainly don't need analytics from Google, the leading spyware-as-a-service company in the world.

I expect open source to become better through writing quality software, engaging with users and if need be doing some surveys or organsising other reach-out initiatives in the open. Not analytics turned on by default but it's-ok-cause-we-tell-you-we're-fucking-you.

[1]: https://en.m.wikipedia.org/wiki/Useful_idiot

> The EU approach to privacy (eroded by lobyying and lack of control over US companies) is that citizens have a right over their information. They can ask what personal information a company has on them, ask that it be corrected or deleted. This has resulted in companies that are more careful with data.

More like, this has resulted in things like nonsensical "Cookie warnings" that only waste the user's time.

Not entirely. I've learned to read the word "cookie" in many different languages.

It has resulted in a lot of good things. Cookie consent is most certainly not one of them.

IMO, the intent was good... but yeah, the implementation is a grand demonstration of what you get when legislators don't understand the technology they're regulating. It would be far better if they'd required browsers, not websites, to show the notifications - much like they already do when a site wants to access your webcam/mic/location/etc[0]. That would mean much less implementation work (once per browser instead of per site), no way for underhanded sites to use cookies without the user being notified or despite the user declining them, consistent UI across all sites...

Such a thing could provide significantly more useful information, too - I envisage a notification with "This site wants to use a cookie on your computer" at the top, "allow/deny, now/always" buttons and a "What are cookies?" link at the bottom, and a user-friendly breakdown of this particular case in between, things like:

• "only visible to this site" vs "visible to ad.doubleclick.net" etc - maybe including, say, the Organization Name from the cookie domain's SSL cert, at least in the case of cookies set to "Secure" (maybe only if the cert's EV)

• "until you close your browser" vs "for a week" etc - perhaps with a way for the user to force session-only if desired

• possibly some kind of warning about snooping risk if the cookie's not marked secure, or not HTTP-only & 3rd-party scripts are on the page, etc

• for the case of 3rd-party cookies, it'd be possible to list which other sites have used the same cookie in the past

And so forth. The most importantant point being that you could actually trust this information - your browser has no motivation to lie to you about it, but any random site might.

[0] eg, https://i.imgur.com/NcxWz8zh.jpg

The issue is: What about technical cookies?

The law allows storing session info, config options, etc without prompting. The browser couldn’t reliably test that.

Unless you’d also let login to sites be handled by the browser, akin to Mozilla’s Persona.

Damn, that’d actually be a much nicer web.

Yeah, that could work.

Or, to look at it another way... so what if the browser pops up notifications more often than the law requires? Might encourage people to make less use of cookies for functionality that doesn't really need them, which would be no tragedy. And if your site really can't do without them, you could pop up a message explaining the situation & politely asking to be unblocked.

I suppose there'd be a danger of alert fatigue... maybe some heuristic analysis of the cookies themselves would be in order, to at least tentatively classify them as "tracking" vs "other". Eg, Google Analytics & Piwik cookies could be identified pretty reliably.

> I suppose there'd be a danger of alert fatigue...

But that's happening with the current solution as well (not to mention all those crappy sites with their modal popups that teach you to close anything opening asap anyway)

Single Sign-on can be implemented without third-party cookies and therefore without the cookie warning.

That cookie warning is just a friendly reminder that you are being tracked everywhere.

Of course, websites that don't track their users are exempt: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm

I guess the EU didn't expect websites to cling to tracking cookies like their lives depended on them.

Cookie law is one of the stupidest laws that EU forced. I had to install additional rules to adblocker to get rid of this nonsense and it still doesn't catch everything and keeps irritating me... I don't care, damn it! http://nocookielaw.com/

Is it truly?

The law is pretty simple: If you track users, or transmit information to third parties which could track the user, you have to get the user to opt-in.

The original intention was to get rid of Facebook’s shadow profiles, which it did – in the EU, websites don’t embed Facebook’s like button anymore, but have a two-click solution, where you have to click it, then it’s actually loaded, then you can like.

That alone is worth such a law.

It is not worth it. I would really want a good way to protect myself as an Internet user from this law that the EU is enforcing on me. To protect myself not from Facebook, not from Google, but from the EU. It also gets in my way as a web developer. The law is not simple. 100 words sentences of law jargon are not simple. Many, many pages of such sentences is the opposite of simple. To be honest I have never really understood the law and I don't think I ever will. Even keeping track of it is far from simple.

But according to this website: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm Cookies clearly exempt from consent according to the EU advisory body on data protection- WP29pdf include: (...) third‑party social plug‑in content‑sharing cookies, for logged‑in members of a social network.

So, I think what you say about Facebook is not true.

> for logged‑in members of a social network.

I was talking about non-logged in users. The shadow profiles.

> The law is not simple. 100 words sentences of law jargon are not simple. Many, many pages of such sentences is the opposite of simple.

The German version of the law is just as simple to read as any newspaper or book you read in German high school, so at least I haven't had an issue before.

Cookie warnings are an indicator showing that a website takes part in a global spying network. But I think instead of warnings browser developers should just disable third-party cookies by default. Sadly, the most popular browser developer by conicidence owns a popular tracking service so that is not going to happen.

> global spying network

Or maybe they want to persist session information?

Maybe browsers should prompt, instead of each website, but it's too late for that now.

> Or maybe they want to persist session information?

That’s specifically exempt from the cookie law: Any technical cookie – session information, config options, etc – is allowed without any request.

The Cookie law only requires opt-in for tracking. Such as Google Analytics.

Yeah, good point. I couldn't recall if it was third-party cookies, or if it were tracking cookies that the requirement stated.

It's the combination of companies gathering ever more personal data and companies proving to be absolutely incapable to prevent leaking personal data that I find worrying even more than the direct spying.

Do you use brew? Have you contributed code to it? Have you installed something using brew, before updating brew for a while?

For me, my answers are yes no yes. A while ago, you did that, and you get an old version of the thing you just installed. With analytics, they saw that many people forget to update before installing after a while, so they added an update step in that case.

I call that progress, no matter how small. I didn't change that and to you didn't change that. The brew devs changed that. Maybe they would have changed it anyway later.. Who knows. But the fact that brew because a tiny tiny bit better because of analytics, in part from me, makes me a happier user. Now I don't need to remember to update before installing.

Of course it's not the best way to "contribute", but it's something. Definitely better than "contributing" your data to companies, like you said.

I can totally see the benefits of telemetry. But it would be way less phishy if it were opt-in, or at least opt-out with a very visible information message.

Opt-out is what commecrial companies do because they do not respect their users' privacy. Free open source software should do the opposite.

By the way I think that browser history should be disabled by default too.

Browser history is useful to user (but maybe the access to it could be restricted by means of authentication). I'm fine with off-line browser history that's accessible only to the user (and not JS running on a website). But sending any of it over the wire should definitely be opt-in.

An unexperienced user might not know that the history is recorded and later can be accidently seen for example by other member of the family. A good software would not allow that.

I remember some IM app for linux had history turned off by default. I was really surprised then.

The problem with this is, do you want every program you ever use, to start prompting you with a series of questions about various opt-in / opt-out questions? I get annoyed enough that gnu parallel keeps asking me about citing it, and that's one program.

    Bash would like to record analyitics. y/n/more information
    > y
    > ls *.c
    ls would like to record information about how you use it.
    y/n/more information.
    > y
    file1.c file2.c file3.c
    > grep 'string' *.c
    grep would like to record some information about your
    usage. y/n/more information.
    > y
    file1.c:8: string
    > vim file1.c
    vim would like to record information usage, to help
    improve vim in future. y/n/more information.
    > y
    The 'C' package in vim would like to ...

Opt-in can be implemented other way without questions. For example, user could set an environment variable or type a command.

Oh, no!

Then we hit the problem that if we don't push that request at users, probably a tiny fraction will turn it on.

Worse, that fraction will be the statistically unusual people who bother reading and finding such options, meaning we can't derive any statistically useful results about the user base from them!

Maybe you should ask them better. For example you could ask for help on the home page of your project or in the beginning of a tutorial. Or maybe they do not want to paticipate. Is it right to ignore this and turn analytics on by default?

The Debian installer gets this right: it prompts you during the install whether it can collect information about installed packages for popcon[1]

[1] http://popcon.debian.org/

I never understood why popcon is necessary. Couldn't you achieve about the same result by just counting downloads on the package mirrors?

Frankly, that's your problem. I don't see even a true desire to make the software better as a legitimate reason to exfiltrate data from people without asking.

No, I want every program I ever use not to leak data about me all over the internet.

I'm amazed we're even having this discussion

Lol, reminds me of what macOS did[1] to me after a recent upgrade:

  $ git pull

  (long wait)

  ^c

  $ git pull

  (got distracted and had to leave keyboard for a bit)

  Can't execute program until you accept xcode license

I couldn't believe it.

1. paraphrasing the words

If I saw something like that, I'd format my drive and install another OS.

The very idea of your shell or file listing program sending analytics to the mothership is ridiculous. They shouldn't be even talking to a network directly. They have a set of well-defined tasks, and spying on you is not one of them.

"The problem with this is, do you want every program you ever use, to start prompting you with a series of questions about various opt-in / opt-out questions?"

Simple answer, Yes.

It would lead to conversations about the elephant in the room. It also alleviates the assumption I trust all providers(comprehend the EULA/ToS) and puts their actions under scrutiny. If more people realized what data is collected and by whom for whom they could make an informed, cost/benefit choice. Other useful results are, what is the applicability of that data to the project, what characteristics define the 'Trusted Partners' that data is shared with and, possibly, inject some restraint into the collectors' decisions of what to collect.

edit: removed unintended paste fragment

Why do they need to use Google Analytics and hand information over to a third party instead of using something hosted?

I get that there may be money involved, but presumably self-hosting also gives them more of the information to build out what they need.

I agree completely with you and majewsky below.

In another comment in this thread by @mikemcquaid (Homebrew lead maintainer):

> (...)and have been trying to find people who will provide us with non-Google hosting but: we're chronically understaffed and underfunded[1]

[1]https://news.ycombinator.com/item?id=13035438

What are the estimated costs for (something like) this?

The issue here is not contribution, but forced/unnanounced contribution. Would it be ok if I steal from your wallet to contribute to Homebrew?

Come now, a bajillion other software projects have "figured out" that people forget to update everything, always, without resorting to this sort of behavior. There's even a whole library, Sparkle, the exists just to solve this problem. Your nonexample of the necessity of analytics merely serves to reinforce the point you are trying to rebut.

> Companies don't need analytics to improve software.

I was with you except this line. Data is needed to make better choices and prioritize improvements. How would you like people to collect data? Google Analytics is free, easy, and powerful. Adding the cost of buioding a KPI tracking and reporting later from scratch... simply would be too much for most open source projects.

Do market studies?

Take a dozen, or two dozen, users and give them your product, let them use it, and get far more results from that?

You can even do these things for free, especially in open source many of your potential users are willing to do this.

The EU approach of “let’s regulate everything and let incompetent out of touch bureaucrats write the legislation” left to annoying (much more than ads for me) cookie banners and other such nonsense. Starting next year, cookies — i.e. often random nonsense numbers — will have to be treated as personal data in EU. I envy US.

>Data is being sent to Google everytime you do almost anything in almost all websites, using the same technology. So what?

This still doesn't mean we should just shut up and take it for desktop software. What anyone does on its OS shouldn't leave the LAN - same critique stands for recent MS endeavour with Windows 10.

I definitely don't mean that we should shut up and take it. But before we complain about an open source project that maaaaany devs use happily, let's complain about those other cases first, yea?

We can complain just fine about whichever software we want, don't try to make up rules and come to us with fake outrage about even greater injustices.

This is a classical attempt to muddy the waters.

Ok, sure. At least complain for both. I didn't see the post referring to anything besides brew. I'm all for protesting and trying to fix any size and kind of injustice. But just don't target the less guilty. brew is still guilty for not having an even bigger announcement. But less target others too, at least. I would hate to see brew or any other similar software be the sole target and have to change for the worse, because it was unlucky enough to be the scapegoat.

>I didn't see the post referring to anything besides brew.

That's because this post is about brew. Windows 10 got tons of flak when it pulled this crap as well. "There are worse cases" is not an excuse for a project doing something shitty.

let's complain about those other cases first, yea?

Search HN for "Windows 10" and you'll get plenty of complaints.

>Data is being sent to Google everytime you do almost anything in almost all websites, using the same technology. So what?

No, it is not so what. This is a major problem with Google instead. The fact that a single company can track majority of the web traffic is a huge risk.

We have to start somewhere. Opt in should always be the standard.

This. Exactly this, thank you.

Sure. Opt in would be nice. But only if it was opt in always and everywhere, and all users, technical or otherwise, knew the reasons why analytics are gathered for a product they use. I think in that case, many people would still opt in. I would. And I would hope users of my products would too.

Yes, and maybe it's okay if we don't have perfect visibility. We've been building things for thousands of years without Javascript event notifications, I'm sure we will do just fine with a little less data

Organ donation?

Yes, there are arguments for organ donation to be opt-out. But that's extreme case, when one loses literally nothing - by virtue of being already dead - and another person stands to gain additional years of life[0]. Some other socially beneficial things also have strong arguments for being opt-out (like retirement plans, because opt-out protects people from their own stupidity/short-sightedness).

But that doesn't change the validity of the proposal that opt-in should be the standard - exceptions from which must have solid reasons. Just making it easier for someone to make money off people is not one of those reasons. Neither is vague "making the product better".

[0] - INB4 yes, there are also valid arguments that opt-out organ donations will reduce doctors' willingness to fight for patient's life. Human societies are complicated.

Yes, there are arguments for organ donation to be opt-out. But that's extreme case, when one loses literally nothing

Actually, I've opted out because my next of kin stand to lose quite a lot (the harvesting of organs needs to be done quickly, well within the mourning period of the people I care about the most). The decision to leave sight of my body needs to be theirs, and theirs alone.

Well if you can't bear the thought of your friends and relatives not being able to stare at your dead corpse for a couple of hours and value that over doing something amazing and saving someone's life then more fool you.

If your in the position to donate organs you most likely died in an accident. You likely won't have that rosy picture of your family and friends around your beside. You might not have anyone.

What a waste.

Yes, fuck you too. Try a little empathy next time, and failing that, reading comprehension.

I said the decision should be theirs. I did not say my body couldn't be parted from them, I said it was their decision to do so. I used to be registered as a donor, but because the law has now changed that my donorship overrides the wishes of my loved ones, I have withdrawn it.

> I said it was their decision to do so

And I said they may not be there to give that decision, so that's moot really. Organs like lungs and hearts expire very quickly. Reading comprehension indeed.

> Try a little empathy next time

For the dead person, or the person who misses out on a life saving organ due to the dead person?

It's your body and your choice obviously, but I think saying it's up to my relatives to decide isn't a great reason to be taken off the donor registry. There is plenty of time for them to grieve but only a few hours to take a vital organ. If you want to do something great if you expire unexpectedly then it's up to you, don't put that on your parter/relatives.

Also somewhat related to this - recently I've realized that this privacy paranoia is going to slow down medical advances coming out from big data so much.

For example your wearables get to collect so much biometric info, if that data can be connected to detecting conditions early it would provide a lot of value down the road. At some point we will have the option to collect data about what you ate, what you did, where you went and then how that affected your biometrics, and we can inexpensively collect huge scale DNA samples, etc. all that data if available publicly could really provide insights in to things that are really not practical in limited group studies.

For reasons such as this I think I'm fine if services collect anonymized (unless we solve identity theft and such security concerns) information about me, I'd just want them to make this data free.

It's not paranoia, it's simple understanding of history and human nature.

Freaking out about disclosed anonymized analytics about package usage in an OSS project is paranoia in my book

> disclosed

Yeah, carrier contracts also "disclose" everything, there's a reason why it's called "small print".

It would only take to make it opt-in, instead of opt-out to rectify this.

May be, but you didn't use the word "paranoia" to describe just this in your previous comment; you described also things like medical information.

I mean the general sentiment. I'm not saying people should have access to your full medical history, personal info, etc. on demand.

I am saying is that these benign things are opt-out not because most people wouldn't want to do them if they weigh the prons and cons but because they don't want to put in the effort of doing so and will just be conservative - which is logical from an individual perspective - but will cause us to lose out on opportunities as a whole.

Also this data is getting collected weather you want it or not, even intelligence people are just taping over their webcams as a security measure - the attitude that we must protect every bit of privacy by default will lead to the future where hidden data collection is the only way to access data - people will be making money off it, it won't be available to general public (for eg. public research) and there will be no transparency about it. And if you think the government will protect you - well they are the biggest transgressor here.

So instead of fighting a lost battle with trying to keep absolute privacy why not just make most of that data public and available and focus on protecting the really sensitive stuff.

> So instead of fighting a lost battle with trying to keep absolute privacy why not just make most of that data public and available and focus on protecting the really sensitive stuff.

Because you can't. You cannot build something that protects the really sensitive stuff out of stuff that's leaking data left and right, making it harder and harder to protect the really sensitive stuff.

> anonymized

Remember; there's no such thing as "anonymized data", there's only "not enough other data to correlate out identities from it".

In France, you are a donor by default if you don't opt-out. In 2018, relatives won't be able to oppose organ donation in case of uncertainty.

Then it's their social contract in their democracy.

> Some of the times it's to make the product better, or better targeted.

Homebrew lead maintainer here. This is exactly why we do it. To repeat myself from below: we're chronically understaffed and underfunded.

> Furthermore, now that you know, for brew specifically, will you opt out?

It's worth noting: if everyone who uses a niche piece of software opt-out when it breaks we'll look at our analytics and likely remove it from Homebrew instead of fixing it. This may be unfair but given the amount of work: we need ways to prioritise. Analytics have helped us do that so we can prioritise fixes on things that are critical for many people.

You do not need telemetry from everyone to make informed decisions like this.

If just 1% of users opt-in to telemetry, you would have more than enough data for a representative sample set.

This is the whole point. You can do the right thing without any loss of data usefulness. So why persist in doing the wrong thing??

And then the 1% will start complaining. "Why me?"

The team behind Brew is doing a great job and if analytics can help them do a better job, then be it. Nobody is forcing you to use it and opting out is simple enough.

Does it have to be Google, the company that already sucks up the most information about pretty much everyone on the internet? Why don't you send the data to your own machines?

We don't have our own machines that are capable of handling this. If you're offering to host them for us for at least two years for free: get in touch.

Email sent. :)

Well now we'll see if the cost excuse was just a smokescreen I suppose.

It's the cost of running the servers, the experience and time to run the servers and the time to adjust our analytics code to use the new system (which I'm willing to do).

Additionally, this (kind) offer is pointing to other organisations that may be able to host the servers and discussing potential solutions to the other options. It's not a slam-dunk by any means.

This is all done in my free time so I don't need an excuse to do or not do any of this.

Hmmm.... probably better to see how it turns out before jumping to conclusions. :)

From initial discussion with Mike, there are two parts that would be needed for a (self hosted) setup:

a) The hosting itself (this is something I can likely help with)

b) Setup and ongoing management of Piwik. This isn't a skill set I have (nor am interested in). However I'm generally thinking the Homebrew Community is big enough to rustle up at least a few people with the right skill set for getting this done (and keeping it done :>).

Trying to get both hosting + Piwik setup/mgmt from the same set of people may be a tall order, so doing them separately is probably more achievable.

As a data point, this kind of approach - sponsored hosting/hw/similar + volunteers to look after Community infra - is used successfully in other projects. PostgreSQL is a good example.

Can't really think of any obvious reasons it wouldn't work for Homebrew too. ;)

> Data is being sent to Google everytime you do almost anything in almost all websites using the save technology

No, it's not. µblock, µmatrix + clean links.

That would be an opt-out strategy, would it not?

Is there a point in running both ublock and umatrix? Also, what do you mean by "clean links"? Striped of "utm..." parts?

Clean Links is a plugin that strips the utm-like trackers, affiliate codes, outbound redirects, window.open, and some other relays from links.

µblock blocks and removes ads and trackers, µmatrix does the same for cookies and JS. Clean links improve page loading times when you click on a link on reddit or Google, it extracts destination link and gets you directly to the destination without redirect, also google, facebook don't know that you clicked the link.

> µblock blocks and removes ads and trackers, µmatrix does the same for cookies and JS.

Not according to its creator https://github.com/gorhill/uBlock/wiki/Blocking-mode

>Yes we know. brew tells you that. And you can disable it.

No, we don't know. This article wouldn't have hit the front page if it wasn't subtle and user-hostile by default (opt-out).

>Data is being sent to Google everytime you do almost anything in almost all websites, using the same technology. So what?

Brew is not a website, it's a CLI tool. People expect this behavior of websites, not of sysadmin tools. How would you feel if you found out your compiler shipped off a copy of your code to a remote server each time you encountered a compiler error "to improve the compiler" and you had to opt out of this behavior?

>Some of the times it's to make the product better, or better targeted. Some other times it's just for spying on the users.

It's always spying, regardless of the motivation.

>How do we expect open source to become better if everyone is being a crybaby because brew got a history of how often they do brew update?

Somehow open source has functioned all of these years without silently harvesting users' usage data. I don't know how new you are to open source, but this is definitely not the way you do QA for an open source project.

That's a bit extreme. A compiler sending your codebase has potential IP implications. Sending your brew commands back to brew is much different.

What commands do you run in brew that isn't specific to brew? Whereas, compiling code is a very specific-to-you scenario. If brew fails, it's likely to be caused by brew itself or a package that is part of the repository. If you your compiler runs into an issue, it's not inherent to the compiler necessarily. I'm not a fan of brew at all, and I can't really find the malice here. Either opt out, stop using brew, or accept it. Why are you on OSX if you care that much about your package manager anyways? Ive worked at many companies, and any that let you choose a MacBook will let you opt for a Linux laptop instead (YMMV I guess).

Opt Out is scammy.

Command line tools do not usually do this at all, particularly FOSS command line tools. This is a very worrying development and reduces my trust in FOSS.

--edit-- to whoever downvoted me, can you explain why?

I love FOSS but I also lovemy privacy. I have come to generally have a default level of trust for popular FOSS projects. Things like this make me question that trust. Why is this wrong?

> This is a very worrying development

Agreed.

> reduces my trust in FOSS

Please don't distrust a whole category because of a single tool. Most FOSS tools don't do this, especially if they're "Free Software" as opposed to just being "open-source", since "Free Software" indicates a moral, not just practical stance on software.

Well perhaps my assumptions about well-known and widely used open source stuff were just too naive.

I guess I'm not really thinking "distrust them like they actively include malware" just that it looks like I need to at least keep a look out for stuff like this.

I love FOSS. I believe in it, I use it all the time, I've made a few minor contributions here and there too. It's not like I'm saying "OMG FOSS is teh evil!", just that maybe my trust level was calibrated a little high :)

> Some of the times it's to make the product better, or better targeted. Some other times it's just for spying on the users. Let's stop complaining

These kinds of complains are fine, I don't think we should stop them.

It's a bit like corruption in politics, it's not going to be solved anytime soon, but complains do raise awareness and prevent abuses. Who know what's going to happen if we stop complaining?

> Will you choose to make its progress slower because of no real security reason?

No real security reason? We can test that. The developer who added this feature can easy earn trust in such statement by changing the disclaimer and making themselves liable if information extracted through this mechanism causes any identifiable harm.

If this is a sure bet, no risk, perfectly guarantied to be safe, then such change should be trivial.

> Data is being sent to Google everytime you do almost anything in almost all websites, using the same technology. So what?

not on browsers I control

> you can disable it

if you know about it

> There are many more that do the same things without telling you

This makes it right?

> Will you choose to make its progress slower because of no real security reason

Some will, you think it's OK not to give them the choice?

> How do we expect open source to become better

Is opt-in that hard?

If it tells us, then this is a wake up call to me because I don't recall ever becoming informed of that. I must have rushed past the notification.

I probably would have still say OK but I like to at least be aware. Shame on me.

And why not make it opt in instead of the contrary?

It takes almost zero effort to implement Piwik instead of giving all your data to Google. A simple donate button will take care of the costs of a $15 per month shared server for this purpose.

Really that is all it takes. Everything else just goes against the fundamentals of open source software, which is, respect user rights.

Right, as if the feds are coming to get me because they know I installed ImageMagick. Oh no.

I have a friend that uses IM to generate memes. So, yeah IM can be used by dissidents. :)

Is tracking user's actions the only way to improve software? That is not what one would expect from free and open source software project.

If developers needs an information about how user uses a program, they should ask them to help.

this is going to sound insulting, but have you tried being an open-source developer?

I've worked on products with tens of thousands of users, and the vast majority of those users never communicate.

Worse (in my opinion), the users who communicate most tend to be experts, leading to programs tending to become better for expert users, and worse for beginners / occasional users -- see for example how many linux programs have options you can turn on to make them more user-friendly, but of course as a beginner how do you find them?

If you look at Google Play Store you will see a lot of comments from non-expert users (you can easily see it from their messages). Maybe that is because writing a comment in Play Store is easier than subscribing to a mailing list many projects still use or registering in a forum.

Also maybe they do not say anything because everything works ok for them?

Worse (in my opinion), the users who communicate most tend to be experts, leading to programs tending to become better for expert users, and worse for beginners / occasional users

On the other hand, not listening to users but analytics leads to dumbed-down inflexible programs that can't get out of their own way for expert users.

If you have "tens of thousands of users" and most of them don't communicate, I'd call that successful. They're satisfied.

>I've worked on products with tens of thousands of users, and the vast majority of those users never communicate.

And your answer to that is to spy on them unless they read fine-grained details that even the generally expert users on this site missed?

I’ve also worked on products with tens of thousands of users, and while tracking is definitely convenient (I recently added a feature where, on first start, the user is informed that crash reports would be sent, and required them to choose "dismiss" or "opt out" before letting them use the app), but it’s no reason to hide it like this.

Nor is it a reason to even try tracking with Google Analytics.

In my case, I ensure that the backend server is also FLOSS, that no problematic data is transferred, and so on. All FLOSS, everything verifiable by the users.

But running Google Analytics? Without prompting the user?

Great...

I don't think the problem is using Google or not. The problem is that software collects and sends data to a network without user's authorization. It is a package manager, not a program for reporting what software you are installing and how exactly you do that and what operating system you are using and user might not expect such behaviour.

Free software is supposed to do what the user wants, not what its developer wants.

> That is not what one would expect from free and open source software project.

Agreed, but please note that Homebrew is only open-source, it is not "free software"[1].

[1] - https://www.gnu.org/philosophy/open-source-misses-the-point....

> Data is being sent to Google everytime you do almost anything in almost all websites, using the same technology. So what?

For websites, there's a standard process for blocking this shit. For desktop applications, there isn't.

Reply on news.ycombinator.com