Hacker News Reader

Couldn't agree more: the shoot first and ask questions later treatment of OSS maintainers needs to stop right now. People who make use of OSS projects need to check their sense of entitlement at the door. People don't realise that a lot of these really valuable projects are run on next to zero budget but one, or a very small handful, of core contributors, who give up their own time to do so.

If things you don't like happen with a project, start a dialogue, fork it, or use something else instead. Don't just wade in making threats.

(Sadly, this has been going on for a very long time: I remember the debacle over .NET 2.0 support in NDoc where the author had some difficult personal circumstances coupled with people constantly hurling abuse at him. Net result: he understandably quit, not just NDoc but all OSS involvement, nobody else wanted to pick up the project, and the project died. This must have been 11 years ago now but it seems like, since then, the problem has if anything become worse.)

Treating your users as idiots is one thing. Users treating you as an idiot is another thing. Neither one of these conditions is acceptable.

As a long-term homebrew user, I am very appreciative of your hard work (and have even contributed here and there), but in that light I am also very disappointed that I have to manually disable analytics and now have a lot less trust in the homebrew project.

In the same way that I would complain if I were to see a bug in your code that radically effects my production, I consider this invasion of privacy - whatever the justification - worthy of complaint, too. Whatever the justification for this, its not an acceptable path to take, and I strongly urge you to consider making Analytics opt-in, and not opt-out. I have no problem with my next 'brew update' pausing, explaining the situation rationally as you have in this post, and giving me a y/n opportunity to proceed with participating in analytics. I do have a serious problem with you assuming that this is okay, not informing me of it in a fashion that makes me aware of the tracking, and just letting it slip in during an update, which I am now even more suspicious of, even though I do them religiously every week, and have done so for years.

You've just made your product less attractive to me as a developer and user. That's a sad state of affairs, and I hope you fix this bug.

> we need to start asking ourselves as a community whether we think treating open-source maintainers like this is more or less likely to encourage more people to work on the open-source software you rely on to do your job.

Exactly this. The homebrew team has done an amazing job for the past 7 years, all free and volunteer work. People threatening with suing the maintainer are poison for the open-source community. But hey, haters gonna hate.

If I understand correctly, the data is anonymized before it is sent to Google [1]. How may people worrying about privacy download from Github using a proxy/vpn solution to hide their IP?

I've listened to the Changelog podcast about Homebrew and first learned about Google Analytics there. I think people do not realize how big homebrew is (in form of usage and traffic). At this scale, the maintainer opted for collecting data anonymously in order to find bottlenecks and improving the entire software stack. You can disable that feature in the same way you would disable cookies in your web browser.

[1]: https://github.com/Homebrew/brew/blob/master/docs/Analytics....

> I'm now trying to plan vacation time to drive for a 14 hour round trip and pick it up

From a happy and grateful Homebrew user, thank you for all the work you are doing. It's really easy for folks to underestimate how much effort is involved in running a project like this. Details like the above should be a reminder that it's clearly a very significant amount of hard, sometimes thankless, work; work which you are in no way obligated to do. There are large numbers of people who owe you a massive debt of gratitude for all the time and hassle that your effort has saved them. And it's quite sad that we (people) tend not to speak up when we are happy, and only make noise when we're upset about something.

Thanks for continuing to work on this project!!

It's surprising to hear that a package manager needs local analytics to figure out which packages are used.

On the other hand it was likewise surprising to hear that homebrew was using github as its CDN.

I don't rely on homebrew to do anything, but I am concerned about the normalisation of surveilance and will point that out in a reasonably polite manner.

> On the other hand it was likewise surprising to hear that homebrew was using github as its CDN.

That sounds a bit weird to me. Homebrew gets developed on GitHub... so using GitHub as a CDN doesn't seem wrong (to me).

Github offers source control services, it's not a package server. The CDN stunt was impacting other customers and they had to restrict brew's access.

Interesting, hadn't heard about it. :)

Sounds like they weren't using GitHub's Releases approach for binaries, instead doing something else. :/

As both a GitHub engineer and Homebrew lead maintainer: that's not true. You're perhaps thinking of CocoaPods where there was some problems which have been addressed through repository reorganisation work on CocoaPods side and a new API that I added to GitHub for Homebrew that makes it easier to avoid no-op `git fetch` runs now.

Just wanted to say thanks for all your hard work, it's appreciated by many. Maybe this wasn't the best choice, but missteps happen. Sadly, we'll never know how it might have been dealt with if people were able to take a deep breath and open a real, constructive dialogue about it rather than immediately freak out and make threats against you, forgetting (or simply not caring) that, by and large, people like you have been doing them huge favors while demanding nothing in return. Pathetic.

It's easy to get lost in all the hate, as those groups tend to be more vocal. So I'm writing this here just to what I reasonably can to stand up against all the negativity. I feel so helpless just reading all these comments.

Homebrew is excellent software, and the malice expressed in this and similar threads does in no way reflect (my) real world experience of people's perception of Homebrew. I would go so far to say it's probably the best piece of software that I know, it's really easy to use, always works and helpful if something goes wrong. Good software is pretty rare to find, especially open source software with no commercial backing.

There is some kind of dispute about privacy, with commercial companies wanting to collect as much data as possible and some people opposing to it. Is not your project picking the wrong side here? This can be used as an argument later: "see, even popular open source projects do this".

I think that giving up on user's privacy is not an acceptable solution. If you don't have enough time to fix all the bugs and nobody is willing to help then nothing can be done.

What I expect from open source software is that an application should not collect and send home any data by default (I understand that it is not written in the license but still expect this). Breaking this expectation makes me and maybe not only me a little disappointed.

> There is some kind of dispute about privacy, with commercial companies wanting to collect as much data as possible and some people opposing to it. Is not your project picking the wrong side here?

As we're not providing information to any commercial company or selling it I don't think this is a reasonable comparison. If we were collecting information to sell and raise funds for the project I'd object to that, too.

I'm not sure it would be as contentious if you were running your own analytics software. But some more privacy-aware users (myself included) have serious reservations about Google's increasingly pervasive data collection.

The fact that Homebrew uses Google Analytics means that it provides Google with more data, even if you don't hand that data over to other companies after the fact.

We've tried extremely hard to ensure that Google cannot tie this information to other information. It uses a randomly generated UUID that you can change at any time and we request IPs be anonymised using the documented method (and I see no evidence that Google lies about this). When there's an alternative that is provided to us for free, can handle our load and stores similar or less personal information to Google Analytics we'll consider it. So far there's been a few offers of help but none of them have met those requirements.

Do you guys have a general concept of monthly cost for e.g. DigitalOcean or similar, just to handle the hosting and bandwidth for a Piwik backend or something similarly not Google? At your scale I'm sure it is well beyond anything I could afford to subsidize given my present responsibilities, but this might possibly be an easier conversation to have in general were it more widely known what kind of costs we're talking about here - I get the impression that part of the GA-related upset may just have to do with the fact that people don't really understand the magnitude of the problem under discussion. (Or I hope so, anyway.)

Google's business is tying information to other information in ways people don't expect, so your "trying very hard" seems likely to fail. Plus, it seems like you're not trying very hard:

> It uses a randomly generated UUID that you can change at any time and we request IPs be anonymised using the documented method...

You already have a UUID. Why give Google the IP at all? Of course, I don't understand your desperate need for "analytics" unless it's a need for approval. Why can't you take all the blog posts talking about "brew" as approval enough?

I realise it's difficult to remember when faced with messages like this, but there are many of us that use Homebrew, accept the tracking, saw the message, and greatly appreciate all of the work you and the team put in.

Keep up the good work.

Haters will always hate. Keep up the good work guys! People seem to think they are entitled to something when using open-source software, but they're not. It's still the people working and maintaining it who get to take the decisions, and if you guys think you need analytics to provide a better tool, go for it.

I also completely understand the need for default opt-in. I probably wouldn't check the prompt and leave the default, but for a project like this, I honestly don't mind sending usage data.

If you're not happy with the direction taken by the maintainers, find another tool.

Hear, hear

How does the status of the project, or your personal affairs, affect design decisions?

A well funded, well staffed project looks very different than an under staffed, under funded one. They have to make harder decisions about what work to prioritize. I think what Mike is saying just emphasizes why they made this choice. What little work is able to be put into homebrew needs to be as targeted and helpful as possible. Analytics help then do that.

So to answer your question, the status of the project and his personal affairs have a huge impact on design decisions.

> They have to make harder decisions about what work to prioritize

Priority isn't a design decision.

Analytics help, but the choice to not opt-in is not excused by "but we need them"

Mike,

I'm just saying that you're putting yourself on risky ground, not that I want to do something personally.

In fact I'd even consider keeping GA enabled IF BEING NOTIFIED.

The current notification is the problem, as it is close to invisble. Hiding output in a long log message is a dark pattern, I think it did not happen out of spite (you just used your normal shell output mechanism to show that).

However: Such a chage of policy is more important than the list of files being removed by git. Even opt out is OK IF THE USER IS INFORMED.

Currently it's like arthur dent being informed about the highway being built ... yeah we did display the notice.

I know building an open source project is no fun and I can really relate to your desire to know more about installations and deinstallations. Personally I don't even object to using google GA, just to the way it feels being snuck beside the radar.

You were notified, I'm sorry if it was not as clear as it could have been. We're always open to PRs to improve the visibility.

That said, I still don't appreciate threats or ideas to sue me as an individual. That's a massively disproportionate threat to me and my family.

> Looking at the website one of homebrew's developers (or at least the website developers) is based over here in Europe. He might be a nice target if you want to raise a stink and litigate.

This certainly sounds like you're advocating for people to - at the very least - harass him.