Anonymous Aggregate User Behaviour Analytics (2016) | Hacker News Reader

Anonymous Aggregate User Behaviour Analytics (2016)

docs.brew.sh

18 pointsneya16 comments

> If Google turned evil the only thing they could do would be to lie about anonymising IP addresses and attempt to match users based on IP addresses.

My worry is that Google is already evil and could be very well lying and silently using the (deanonymized) data. I have no problems with Homebrew getting that data through their own platform but seriously, fuck Google.

Google's "anonimized IP" means setting the last octet to 0. At best that is a 256->1 grouping[1]. If you're the only person on your local class C network (x.y.z.0-255), your analytics uniquely map to your IP.

Google doesn't have to lie about how they handle IPs - they document how little anonymity they provide. Anybody claiming GA provides any real anonymity either didn't read the documentation[2] for that feature, or they are lying.

[1] https://news.ycombinator.com/item?id=13639921

[2] https://support.google.com/analytics/answer/2763052?hl=en

This looks like they put a lot of good thought into it.

They've got a clear outline of what is and is not shared, why they are collecting it, links to the source code that handles it, explicit notice along with an easy opt-out mechanism, etc.

They've been doing this for years now (since at least 2015). The title here implies that the change is recent.

Shouldn't it be opt-in, at least in Europe (with GDPR coming)?

not if there isn't any PII

It can’t be identified back to an user. It is not personal data.

> It can’t be identified back to an user.

It's trivially associated to your IP. Google, if they chose to, could trivially tie these GA records to your personal profile.

> It is not personal data.

It's behavioral data that helps Google reconstruct your pattern-of-life. Knowing the tools you use can be very revealing.

Your first statement is misleading. It is not trivially associated to your IP.

See:

https://github.com/Homebrew/brew/blob/master/Library/Homebre...

https://developers.google.com/analytics/devguides/collection...

https://support.google.com/analytics/answer/2763052?hl=en

Of note:

    If the IP anonymization method is used, then at no time
    is the full IP address written to disk as all
    anonymization happens in memory nearly instantaneously
    after the request has been received.

See my other post[1]. Yes, they are not storing all of the IP; they are simply storing the most interesting 3/4 of it (including the ASN). The most difficult problem they have to solve is a 1-in-256 guess, if-and-only-if the other 255 neighboring IPs in the same "anonimized" bucket also generate similar types of GA records. In practice, the realities of IP distribution and not-perfectly-uniform host behavior will make this one of the easiest records to correlate.

[1] https://news.ycombinator.com/item?id=16787053

This is easily turned off via your shell config file or through homebrew itself thankfully.

   export HOMEBREW_NO_ANALYTICS=1

   brew analytics off

Is opt_out GDPR compliant?

It appears so.

https://gdpr.report/news/2018/02/01/gdpr-google-analytics-2/

This page carefully describes what data they are going to be using, so I don't see any reason it would violate it especially since they're not passing any PII.

Thx for the article, but I can't see how you come to the conclusion you draw based on it. It does no clarify the opt-in/opt-out stance at all. In contrast ( https://searchengineland.com/report-google-asks-publishers-t...) states

"Use of personal data cannot be based on implicit or opt-out consent. There must be “a statement or a clear affirmative action” indicating a willingness to share the information. Google will reportedly be capturing that consent for properties that it controls, such as Google.com and YouTube. But the company is asking third-party publishers to collect consent in situations where Google’s technology and ad targeting are behind the scenes (see below). "

Which to me as a layman reads you need to have users opt-in to consenting to be used in Google Analytics if it is used in your product/site.

Yep, you're right. Then no, I don't see how Homebrew complies with GDPR as it's opt-out.

That’s not really news, it was a big discussion a few years ago.

Reply on news.ycombinator.com