Hacker News Reader

Comment by froh42 | Hacker News Reader

As I didn't update brew for a long time I did not have the analytics version. So I upgraded to see what happens.

In fact it did NOT prompt me when enabling analytics, but it did display a notice (hidden in several hundred lines of output during brew upgrade):

-------------------

+ 5a9e19f...7f13b37 master -> origin/master (forced update)

* [new tag] 0.1 -> 0.1 HEAD is now at 7f13b37 Merge pull request #1562 from woodruffw/check-admin-group

==> Homebrew has enabled anonymous aggregate user behaviour analytics

Read the analytics documentation (and how to opt-out) here: https://git.io/brew-analytics

==> Tapping homebrew/core

Cloning into '/usr/local/Library/Taps/homebrew/homebrew-core'...

remote: Counting objects: 3765, done.

remote: Compressing objects: 100% (3654/3654), done.

-------------------

I do not consider this a prominent warning. Rather it is sneaking analytics silently in the back door.

Looking at the website one of homebrew's developers (or at least the website developers) is based over here in Europe. He might be a nice target if you want to raise a stink and litigate. If I'd were a contributor I'd not want to have my name associated to something like this, even if it just happened out of stupidity not out of malice.

View on HN

> He might be a nice target if you want to raise a stink and litigate.

I read your explanation downthread that you didn't mean anyone should do this, but the sentence as written is beyond the pale. This is not good community behavior. Please do a better job of considering other people when you post here.

> Looking at the website one of homebrew's developers (or at least the website developers) is based over here in Europe. He might be a nice target if you want to raise a stink and litigate.

Homebrew lead maintainer here. We're chronically understaffed and underfunded. We have analytics so we can make Homebrew better by figuring out how to prioritise security, maintenance and bug fixes on packages based on how much they are used and how often they fail. I've been working on making regular dumps of this data and have been trying to find people who will provide us with non-Google hosting but: we're chronically understaffed and underfunded.

One of our CI machines burnt out last night so I'm now trying to plan vacation time to drive for a 14 hour round trip and pick it up. While I'm doing that someone points out there's someone on Hacker News threatening to sue me. This is for working on software (mostly) in my free time that's used by people (mostly) for their employment and obtained for free. After the last thread on this (https://news.ycombinator.com/item?id=11566720) I had people emailing me to tell me I'm a nazi and should kill myself for weeks.

Everyone here who objects to the analytics is well within their rights to do so (and should either opt-out or stop using Homebrew) but we need to start asking ourselves as a community whether we think treating open-source maintainers like this is more or less likely to encourage more people to work on the open-source software you rely on to do your job.

Couldn't agree more: the shoot first and ask questions later treatment of OSS maintainers needs to stop right now. People who make use of OSS projects need to check their sense of entitlement at the door. People don't realise that a lot of these really valuable projects are run on next to zero budget but one, or a very small handful, of core contributors, who give up their own time to do so.

If things you don't like happen with a project, start a dialogue, fork it, or use something else instead. Don't just wade in making threats.

(Sadly, this has been going on for a very long time: I remember the debacle over .NET 2.0 support in NDoc where the author had some difficult personal circumstances coupled with people constantly hurling abuse at him. Net result: he understandably quit, not just NDoc but all OSS involvement, nobody else wanted to pick up the project, and the project died. This must have been 11 years ago now but it seems like, since then, the problem has if anything become worse.)

Treating your users as idiots is one thing. Users treating you as an idiot is another thing. Neither one of these conditions is acceptable.

As a long-term homebrew user, I am very appreciative of your hard work (and have even contributed here and there), but in that light I am also very disappointed that I have to manually disable analytics and now have a lot less trust in the homebrew project.

In the same way that I would complain if I were to see a bug in your code that radically effects my production, I consider this invasion of privacy - whatever the justification - worthy of complaint, too. Whatever the justification for this, its not an acceptable path to take, and I strongly urge you to consider making Analytics opt-in, and not opt-out. I have no problem with my next 'brew update' pausing, explaining the situation rationally as you have in this post, and giving me a y/n opportunity to proceed with participating in analytics. I do have a serious problem with you assuming that this is okay, not informing me of it in a fashion that makes me aware of the tracking, and just letting it slip in during an update, which I am now even more suspicious of, even though I do them religiously every week, and have done so for years.

You've just made your product less attractive to me as a developer and user. That's a sad state of affairs, and I hope you fix this bug.

> we need to start asking ourselves as a community whether we think treating open-source maintainers like this is more or less likely to encourage more people to work on the open-source software you rely on to do your job.

Exactly this. The homebrew team has done an amazing job for the past 7 years, all free and volunteer work. People threatening with suing the maintainer are poison for the open-source community. But hey, haters gonna hate.

If I understand correctly, the data is anonymized before it is sent to Google [1]. How may people worrying about privacy download from Github using a proxy/vpn solution to hide their IP?

I've listened to the Changelog podcast about Homebrew and first learned about Google Analytics there. I think people do not realize how big homebrew is (in form of usage and traffic). At this scale, the maintainer opted for collecting data anonymously in order to find bottlenecks and improving the entire software stack. You can disable that feature in the same way you would disable cookies in your web browser.

[1]: https://github.com/Homebrew/brew/blob/master/docs/Analytics....

> I'm now trying to plan vacation time to drive for a 14 hour round trip and pick it up

From a happy and grateful Homebrew user, thank you for all the work you are doing. It's really easy for folks to underestimate how much effort is involved in running a project like this. Details like the above should be a reminder that it's clearly a very significant amount of hard, sometimes thankless, work; work which you are in no way obligated to do. There are large numbers of people who owe you a massive debt of gratitude for all the time and hassle that your effort has saved them. And it's quite sad that we (people) tend not to speak up when we are happy, and only make noise when we're upset about something.

Thanks for continuing to work on this project!!

It's surprising to hear that a package manager needs local analytics to figure out which packages are used.

On the other hand it was likewise surprising to hear that homebrew was using github as its CDN.

I don't rely on homebrew to do anything, but I am concerned about the normalisation of surveilance and will point that out in a reasonably polite manner.

> On the other hand it was likewise surprising to hear that homebrew was using github as its CDN.

That sounds a bit weird to me. Homebrew gets developed on GitHub... so using GitHub as a CDN doesn't seem wrong (to me).

Github offers source control services, it's not a package server. The CDN stunt was impacting other customers and they had to restrict brew's access.

As both a GitHub engineer and Homebrew lead maintainer: that's not true. You're perhaps thinking of CocoaPods where there was some problems which have been addressed through repository reorganisation work on CocoaPods side and a new API that I added to GitHub for Homebrew that makes it easier to avoid no-op `git fetch` runs now.

Interesting, hadn't heard about it. :)

Sounds like they weren't using GitHub's Releases approach for binaries, instead doing something else. :/

Just wanted to say thanks for all your hard work, it's appreciated by many. Maybe this wasn't the best choice, but missteps happen. Sadly, we'll never know how it might have been dealt with if people were able to take a deep breath and open a real, constructive dialogue about it rather than immediately freak out and make threats against you, forgetting (or simply not caring) that, by and large, people like you have been doing them huge favors while demanding nothing in return. Pathetic.

It's easy to get lost in all the hate, as those groups tend to be more vocal. So I'm writing this here just to what I reasonably can to stand up against all the negativity. I feel so helpless just reading all these comments.

Homebrew is excellent software, and the malice expressed in this and similar threads does in no way reflect (my) real world experience of people's perception of Homebrew. I would go so far to say it's probably the best piece of software that I know, it's really easy to use, always works and helpful if something goes wrong. Good software is pretty rare to find, especially open source software with no commercial backing.

There is some kind of dispute about privacy, with commercial companies wanting to collect as much data as possible and some people opposing to it. Is not your project picking the wrong side here? This can be used as an argument later: "see, even popular open source projects do this".

I think that giving up on user's privacy is not an acceptable solution. If you don't have enough time to fix all the bugs and nobody is willing to help then nothing can be done.

What I expect from open source software is that an application should not collect and send home any data by default (I understand that it is not written in the license but still expect this). Breaking this expectation makes me and maybe not only me a little disappointed.

> There is some kind of dispute about privacy, with commercial companies wanting to collect as much data as possible and some people opposing to it. Is not your project picking the wrong side here?

As we're not providing information to any commercial company or selling it I don't think this is a reasonable comparison. If we were collecting information to sell and raise funds for the project I'd object to that, too.

I'm not sure it would be as contentious if you were running your own analytics software. But some more privacy-aware users (myself included) have serious reservations about Google's increasingly pervasive data collection.

The fact that Homebrew uses Google Analytics means that it provides Google with more data, even if you don't hand that data over to other companies after the fact.

We've tried extremely hard to ensure that Google cannot tie this information to other information. It uses a randomly generated UUID that you can change at any time and we request IPs be anonymised using the documented method (and I see no evidence that Google lies about this). When there's an alternative that is provided to us for free, can handle our load and stores similar or less personal information to Google Analytics we'll consider it. So far there's been a few offers of help but none of them have met those requirements.

Do you guys have a general concept of monthly cost for e.g. DigitalOcean or similar, just to handle the hosting and bandwidth for a Piwik backend or something similarly not Google? At your scale I'm sure it is well beyond anything I could afford to subsidize given my present responsibilities, but this might possibly be an easier conversation to have in general were it more widely known what kind of costs we're talking about here - I get the impression that part of the GA-related upset may just have to do with the fact that people don't really understand the magnitude of the problem under discussion. (Or I hope so, anyway.)

Google's business is tying information to other information in ways people don't expect, so your "trying very hard" seems likely to fail. Plus, it seems like you're not trying very hard:

> It uses a randomly generated UUID that you can change at any time and we request IPs be anonymised using the documented method...

You already have a UUID. Why give Google the IP at all? Of course, I don't understand your desperate need for "analytics" unless it's a need for approval. Why can't you take all the blog posts talking about "brew" as approval enough?

I realise it's difficult to remember when faced with messages like this, but there are many of us that use Homebrew, accept the tracking, saw the message, and greatly appreciate all of the work you and the team put in.

Keep up the good work.

Haters will always hate. Keep up the good work guys! People seem to think they are entitled to something when using open-source software, but they're not. It's still the people working and maintaining it who get to take the decisions, and if you guys think you need analytics to provide a better tool, go for it.

I also completely understand the need for default opt-in. I probably wouldn't check the prompt and leave the default, but for a project like this, I honestly don't mind sending usage data.

If you're not happy with the direction taken by the maintainers, find another tool.

Hear, hear

How does the status of the project, or your personal affairs, affect design decisions?

A well funded, well staffed project looks very different than an under staffed, under funded one. They have to make harder decisions about what work to prioritize. I think what Mike is saying just emphasizes why they made this choice. What little work is able to be put into homebrew needs to be as targeted and helpful as possible. Analytics help then do that.

So to answer your question, the status of the project and his personal affairs have a huge impact on design decisions.

> They have to make harder decisions about what work to prioritize

Priority isn't a design decision.

Analytics help, but the choice to not opt-in is not excused by "but we need them"

Mike,

I'm just saying that you're putting yourself on risky ground, not that I want to do something personally.

In fact I'd even consider keeping GA enabled IF BEING NOTIFIED.

The current notification is the problem, as it is close to invisble. Hiding output in a long log message is a dark pattern, I think it did not happen out of spite (you just used your normal shell output mechanism to show that).

However: Such a chage of policy is more important than the list of files being removed by git. Even opt out is OK IF THE USER IS INFORMED.

Currently it's like arthur dent being informed about the highway being built ... yeah we did display the notice.

I know building an open source project is no fun and I can really relate to your desire to know more about installations and deinstallations. Personally I don't even object to using google GA, just to the way it feels being snuck beside the radar.

You were notified, I'm sorry if it was not as clear as it could have been. We're always open to PRs to improve the visibility.

That said, I still don't appreciate threats or ideas to sue me as an individual. That's a massively disproportionate threat to me and my family.

> Looking at the website one of homebrew's developers (or at least the website developers) is based over here in Europe. He might be a nice target if you want to raise a stink and litigate.

This certainly sounds like you're advocating for people to - at the very least - harass him.

> He might be a nice target if you want to raise a stink and litigate.

* That Phone in your pocket? "No problem"

* The browser you're using right now? "This is fine"

* Your internet-enabled TV? "All good"

* Open source project collecting usage metrics? "Woah, hold on there buddy"

Get some perspective.

They're completely transparent about which very limited usage metrics they use. You can inspect exactly which metrics are sent. And you can turn off these metrics if you want.

You're not paying anything for the product, and the analytics aren't being used to target you as a consumer, or to pitch advertising at you.

Simply by reading this page on hacker news you've sent more information to a third party than you would using brew.

if you want to raise a stink

If you have a judge who is not completly dumb he would laugh you off for such litigation. If you have a judge who still has his staff print out internet pages for him it might get compilicated for you as a contributor. Idiot judge already happened to me, that was an expensive lesson life taught me.

So no, I wouldn't risk sticking my name on something like that.

Because everybody else does it, doesn't mean you don't get away with it. (And over here the big boys google/apple can do a lot of things the small ones can't even begin to try - they have the advantage of getting before a "high enough" court with intelligent judges)

> If you have a judge who is not completly dumb he would laugh you off for such litigation.

Why?

Under European law, you can only transmit such information or track it if you have an explicit opt-in to it.

I'd doubt you'd get laughed out of court, considering the Cookie law was written for exactly this case.

They're completely transparent after they already took your data. Almost nobody notices that tiny notice.

If they were transparent, they would ask you before transmitting data.

Websites tracking you is expected. Local tools tracking you is not.

We do tell you before transmitting any data (as shown in the original comment).

I think the, valid, concern mentioned in the original comment is that the notification of this is not prominent enough.

Also Ideally I'd suggest you should be looking for informed consent before starting to gather information of this nature where an application previously did not do it.

Something similar to Debian's request to submit data for the package popularity ratings that is provided when you install debian might make sense.

Debian's popularity contest package gets it right. You're asked once during installation, with the default being to decline. If you keep choosing "next" without reading or thinking you get a working installation with your privacy intact, and it never bothers you again.

Debian's popularity contest package is completely biased and nobody uses it as a serious source. You can’t expect to have reliable data with opt-in.

It's used for bug triage, so I don't think bias is a problem. The bias is rewarding people who opted in by increasing the chance bugs in their software will be fixed.

I prefer local tools tracking me. That means I use them, that's why they are installed. And I want them to get better. That's why I'm fine with them tracking me. A random website, though, I honestly don't care, but if I could choose, I would opt out. Makes sense, right?

You're pretending there is an inconsistency in their argument when there is none. Let me give you a slightly (ever so slightly) exaggerated explanation of why you're incorrect in your analogies.

* A phone is a communications device. We know it transmits information. Unwanted tracking that exceeds the metadata strictly necessary for the execution of it's purpose and usage of this metadata for any other purpose needs to be opt-in.

* The browser is a communications application. We know it transmits information. Unwanted tracking that exceeds the metadata strictly necessary for the execution of it's purpose and usage of this metadata for any other purpose needs to be opt-in.

* An internet-enabled TV. We know it transmits information. Unwanted tracking that exceeds the metadata strictly necessary for the execution of it's purpose and usage of this metadata for any other purpose needs to be opt-in.

* Open source project collecting usage metrics? Downloading software packaged generates metadata. We understand that, and use the software on that basis. Any usage of that metadata and tracking my usage habits of said Open Source project needs to be opt-in.

>Looking at the website one of homebrew's developers (or at least the website developers) is based over here in Europe. He might be a nice target if you want to raise a stink and litigate

You're perfectly within your right to feel conned by the data collections. I myself opted-out after I saw the message when I installed home-brew few months ago and, yes, I am a bit bummed that I have to take these extra efforts to opt out.

But threatening to sue for a completely free software that people maintain voluntarily? You're not even just saying that there is a potential for litigation, but you actually said that because they're a "nice target"?? HN mods can ban me for all I care, but I have to say you're one entitled asshole, and this kind of behaviour is the reason of why so many open source project maintainer burnt out.

There are too many projects as there are, let them "burn out" and make way for those that aren't spyware.

Giving away something for free gives no guarantee of quality, but doesn't justify stealing analytics.

How about try not to assume malice out of people's free software from the very first thing they did that you don't agree with?

Its open source. Why not open an issue, contribute a patch to make the process opt-in, start a discussion, start a fork? Oh, of course, why would we do that when we can attack the maintainers, call their software a spyware, and threaten to sue instead? While we're at it, let's use words like "spyware" and "stealing" to paint them in an even worse light.

I, for one, loves the homebrew project, and I don't want the maintainers to burn out. There isn't much that I can contribute to the project, but calling out this kind of behaviour is the least I could do, and thats exactly what I'll do.

> Why not open an issue

The maintainer already stated it's not a bug, plus the nature of the message implies opt-out was a design choice.

> of course, why would we do

Why start a fork before "attacking" the maintainer? Are you suggesting we need to audit every code base we use? As reasonable as checking every box of morning cereal for glass shards.

The software is spyware. Words like "spyware" and "stealing" are correct, I don't care how it paints the maintainer to describe the situation accurately, they created that situation.

> calling out this kind of behaviour is the least I could do

by "calling out this kind of behaviour" you attacking critics with poor arguments? That's not support, its fan-boyism.

> The software is spyware. Words like "spyware" and "stealing" are correct, I don't care how it paints the maintainer to describe the situation accurately, they created that situation.

No, that is not "correct". The aren't even tracking their user, they are tracking the use of their software. Your use of the words are manipulative and dishonest.

> by "calling out this kind of behaviour" you attacking critics with poor arguments? That's not support, its fan-boyism.

None of the things I called out are "critics". Legal threats because they live in a place that makes them a "good target"? Calling the software a "spyware" because they collect usage data? That is not critic. That is bullying.

If the people doing those things think the I'm a fanboy for calling them out, since clearly logic matters little to them anyway.

spyware : "software that enables a user to obtain covert information about another's computer activities by transmitting data covertly from their hard drive."

Nothing there mentions user tracking. If I don't know information about my computer is being transmitted, it's spyware.

> Legal threats

I didn't comment on this because I didn't say that.

> That is bullying.

I disagree. It is accurate, not disproportionate. Plus you misrepresent my opinion; it is not because "they collect usage data", but because "they collect usage data without your permission"; hence spyware.

> If the people doing those things think the I'm a fanboy for calling them out, since clearly logic matters little to them anyway.

In order to "call someone out" you need to argue the case, so bit early to bring out the ad-homs.

I'm calling you a fanboy because you suggested defending the author is your 'contribution' to his project, which biases your perspective.

There you have it. Stop claiming there is a "prompt".

It's the same as the "3rd party cookies enabled by default" setting on Firefox. It's the wrong default if you really care about your user's privacy as Firefox claims to do. It's hard to even find the setting unless you know where it is. And it's Google who is paying so it stays the way it is and patches that change it are rejected.

It is not Google paying for 3rd party cookies. Firefox tried to change it and it became a publicity disaster for them.

Suddenly they were met with headlines like "Mozilla/Firefox hates small business owners" and they are simply not capable of handling a publicity attack (remember the whole CEO thing?) and they caved in.

Proof? Safari has 3rd party cookies disabled by default and I don't hear any complaints.

The number of sites that don't work without 3rd party cookies enabled is very small and from my point of view they are plain broken.

It was in nightly 3 years ago. If you followed along on Planet.mozilla you could see the story unfold, but it is hard to find a single source that summaries everything.

But the bottom line is, despite Safari already doing this, Mozilla was met with a lot of hostility when they tried to implement it, and eventually gave up.

Here's an excerpt from Computer world, that'll give you an idea about how things were unrolling back then.

Mozilla has effectively postponed Firefox's controversial third-party cookie-blocking policy for several months.

...

Months ago, when Mozilla's proposal appeared set to debut in Firefox 22, several online advertising groups, including the Interactive Advertising Bureau (IAB) and Association of National Advertisers (ANA), vehemently objected, claiming that the on-by-default blocking would "disenfranchise every single Internet user" and result in the shuttering of small businesses and small websites. An official with the ANA promised that Firefox users would see more ads, not fewer, if the feature was switched on.

http://www.computerworld.com/article/2498038/data-privacy/mo...

> Looking at the website one of homebrew's developers (or at least the website developers) is based over here in Europe. He might be a nice target if you want to raise a stink and litigate.

Incredibly shameful comment. Calling for someone to be sued, and then especially targeting someone who'd be vulnerable. Fucking unbelievable. Flagged this hard.

Man, it would be great if analytics couldn't be opted out of and you insane paranoiacs would leave the rest of us normal people alone. Went straight for the nuclear option: litigation.

It may well be problematic under data protection laws in the EU.

Suing straight off the bat is bad, but if they refuse to so anything about it may be the only option.

> If you flag something, please don't also comment that you did.

This is why I think I missed it on all my machines, it really isn't noticable but it's a _big deal_.

*Edit: I run brew update; brew upgrade; brew clean on at least two of my three machines at least once a day, while I should be more vigilant opt-out is really something I'd expect from Microsoft or Google themselves and not an open source project such as Brew.

The whole point of opt out systems is to bury this info. That was very much intentional.

Reply on news.ycombinator.com