Hacker News Reader

Comment by angrygoat | Hacker News Reader

Just ran an update and got this:

   ==> Homebrew has enabled anonymous aggregate formulae and cask analytics.
   Read the analytics documentation (and how to opt-out) here:
     https://docs.brew.sh/Analytics

Opt-out analytics capture? A bit of a shame it's not opt-in.

The fix is to run:

   brew analytics off

View on HN

This is not new, it's been around since 2016: https://github.com/Homebrew/brew/commit/1238c65ba14831bc571c...

So it is user-hostile because of data collection, and that the opt-out is not preserved :-)

It's opt-in because you don't have to use brew if you don't want to. It helps the devs do their jobs better (a job they do for free), and it is a free tool someone is under no obligation to use.

Previous discussion: https://news.ycombinator.com/item?id=11566720

Please don’t subvert the meaning of “opt-in” like this; also, mentioning “free” does not give you a pass to shut down any complaints about the software. To address your other points: I disagree that opt-in analytics necessarily help.

We can disagree on both points. I'm making the effort to defend people who do real work (brew devs) vs an entitled vocal minority. Time is the ultimate non-renewable resource, and it shouldn't be wasted by grandstanders.

User hostile patterns should be raised and addressed. This is not user hostile in my opinion (considering the very little data collected, and the efforts to anonymize), it is plainly obvious what data is collected, you can observe what data will be sent, you can opt out of data collection (which the devs find of value), and you can choose not to use the software.

It has clearly not had an impact on usage of the tool:

https://formulae.brew.sh/analytics/os-version/365d/

The Homebrew maintainers do real work, but I disagree with your characterization of this complaint as “entitled” and coming from time-wasting “grandstanders”. I’d be happy to hear how you disagree but trivializing the issue doesn’t really help :(

> “entitled”

I think we've reached an impasse. Fundamentally, it's brew's project, not the user's, and my opinion is that the brew project has met the burden of attempting to balance their needs (data collection) with those of their users (privacy). It is very easy to dictate a mandate when it's not your time. Compromise is necessary, inevitable even.

> "grandstanders"

If someone would like to donate your time, effort, and funds to standing up analytics infra solely for Brew's use (or perhaps in aggregate for a group of OSS projects) so that they could avoid communicating with Google infra, I fully support such efforts. Historically, I have not seen this occur when a group takes issues with activities of an open and/or free project and the project has offered to accept the necessary resources from those who desired to be stakeholders via their input.

I actually chose to stop using the project and contribute to another one because I felt that I could not align my values with Homebrew’s and they did not seem to be willing to compromise on this and other concerns that had been brought up. (With this specific issue, the “opt-out” part is more important to me than the “Google” one, so a self-hosted analytics solution would only be somewhat effective in alleviating my concerns.)

I commend you for aligning your actions with your principles.

It could cure cancer; it is still done without consent of the user whose computer it runs on, which is unethical. It violates their privacy, which is an abuse of their human rights.

You should not make software that abuses the human rights of your users.

If you bought a plain old alarm clock and it silently connected to wi-fi and told the manufacturer every time you were in the room with it via a motion sensor, without notifying you when it did so or asking you if you want that, you would call that a defective product, and you would say that the front of the box, that says nothing about being a tracking device, is fraudulent.

It’s the same with a package manager, or any other software tool. Tracking in this way without consent is not acceptable, even if there is some fine print on the back of the box that tells you about it.

There are many human rights hills to die on. This is not that hill.

The opt-out does seem to be preserved after an upgrade. I had it off, ran the upgrade, and checked with `brew analytics`.

The real fix is to set

    export HOMEBREW_NO_ANALYTICS=1

in your .bashrc or similar prior to installing homebrew, otherwise it phones home during install before you can run the analytics off command. Do not use or recommend the analytics off command; homebrew will still spy on you before you get a chance to use it.

The claim that it is anonymous is also a lie: your IP address is transmitted alongside the data to Google, who absolutely knows who that IP address belongs to. Additionally, homebrew generates a unique tracking identifier on install, to track you across IP addresses (so Google receives your travel history, too). It is absolutely not anonymous.

This sort of nonconsensual tracking is deeply unethical, and the developers of this software should be ashamed of the fact that they are making spyware.

Can this collected data be de-anonymized and cause serious privacy leaks? If not, I’d help the devs ship a better product - it’s the least I can do other than contributing code.

> I’d help the devs ship a better product

Reinforcing the sentiment that this decision should be in the hands of the user, especially considering the first part of the question is not an easy one to answer.

Reply on news.ycombinator.com