5 ms·

That’s not the point. I don’t want any software sending analytics unless I specifically allowed it.

darkwater 4y ago
Then you can either: 1) don't use the software 2) analyze the software source code to understand what it does before using it I tend and prefer to assume good-will WRT telemetry in well-known and independent opensource projects.
- predmijat 4y ago
  Disagree, it should be the norm.
- vetinari 4y ago
  You forgot 3) Complain at different intensities, up to the shaming, about the unethical dark patterns employed by the software, no matter whether it is open source or not, to make authors of the software aware, that what they do is not welcome by their users.
- glenngillen 4y ago
  I use Little Snitch to alert on any outbound connections and make a decision. The google stuff immediately got a permanent blackhole for Homebrew. Anything I'm uncertain of I'll give a short-term approval (30mins) to not break anything. After a couple of rounds of execution (and sometimes some trial & error) you can usually work out which requests are essential and which are some notifications/tracking thing.
  - daneel_w 4y ago
    So you didn't see the notice brew(1) gives you on first run?
    - glenngillen 4y ago
      I can't recall, though this approach isn't specific to homebrew. I block it permanently at a network/process level rather than having to remember to set a ENV var.
nicbou 4y ago
You know, as the law requires in the EU
- st3fan 4y ago
  That is not actually how the GDPR works. Anonymous telemetry without PII does not need any consent.
- Xylakant 4y ago
  That is a very simplifying view of the legal situation and that's not helpful at all. First, it only applies if you collect PII - depending on what they collect, they might not be subject to the GDPR at all. Second, informed consent is only one of the options that allows collection and storage of PII. There are various other reason that allow collection and storage of PII, among them "Legitimate interest". For example, it is considered legitimate to store webserver logs containing PII (IP Addresses) for purposes of fraud analysis, unauthorized system access etc. Whether a specific collection of data is legitimate under those clauses depends on the specifics of a case (who has access, what's the exact purpose, how long you store, ...) - ask a lawyer if you need an assessment. Depending on what they log and how they log, they may be either in the clear or in a bad place, but it's definitely not as simple as "the law requires no logging".
  - jeroenhd 4y ago
    The analytics page describes them tracking information across time with a unique user identifier. They claim that identifier doesn't identify you, but it's attached to an exact Brew install so it does track your personal account on your machine at the very least; I'd classify that as PII. Had they not submitted unique user tokens I think you mag be right. However, that's not how the analytics seem to work. The law does allow logging for a variety of things but in this case I'd say they're in the wrong. They assume that it's okay because they don't track you across websites and that's good to know, but that's not the point.
- pimterry 4y ago
  I don't think that's true - AFAICT there's no EU law banning analytics. EU law just restricts storing & processing _personal_ data (GDPR) and storing unnecessary data on machines without consent (ePrivacy/'cookie law'). If you want to log fully anonymized data, without persistent tracking ids and without leaking personal data to 3rd parties en route (so no "send it to Google and they promise to anonymize the IP afterwards") then you're all good (but IANAL!). The only reason you see all those cookie notices and GDPR consent requests is because so few companies are willing to accept even the tiniest tradeoff in their metrics to protect their users' privacy.
eesmith 4y ago
FWIW, it gives you a warning and the chance to disable analytics before sending any analytics. https://docs.brew.sh/Analytics https://docs.brew.sh/Analytics > Homebrew gathers anonymous aggregate user behaviour analytics using Google Analytics (until our in-progress migration to our own InfluxDB). You will be notified the first time you run brew update or install Homebrew. Analytics are not enabled until after this notice is shown, to ensure that you can opt out without ever sending analytics data.
prepend 4y ago
I feel the same way. I think it’s not cool when orgs track telemetry with opt out. But it’s not cool like when you’re at a party and you go off and fart in the corner as no one’s there and then a few seconds later someone walks by and smells it. Continuing the analogy, telemetry with no opt out is like farting silently amongst a group of people. And tracking identified user requests while selling data is like slapping each person at the party while farting in their face. And I guess opt in telemetry is like holding in your fart and people notice and might feel some discomfort at your discomfort.
- notpushkin 4y ago
  What.
macintux 4y ago
Agreed, I was shocked when I installed the Dart programming language and found out it sends analytics by default. A programming language!
- orangepurple 4y ago
  An implementation of a build system for a programming language

Then you can either: 1) don't use the software 2) analyze the software source code to understand what it does before using it I tend and prefer to assume good-will WRT telemetry in well-known and independent opensource projects.

predmijat 4y ago
Disagree, it should be the norm.
vetinari 4y ago
You forgot 3) Complain at different intensities, up to the shaming, about the unethical dark patterns employed by the software, no matter whether it is open source or not, to make authors of the software aware, that what they do is not welcome by their users.
glenngillen 4y ago
I use Little Snitch to alert on any outbound connections and make a decision. The google stuff immediately got a permanent blackhole for Homebrew. Anything I'm uncertain of I'll give a short-term approval (30mins) to not break anything. After a couple of rounds of execution (and sometimes some trial & error) you can usually work out which requests are essential and which are some notifications/tracking thing.
- daneel_w 4y ago
  So you didn't see the notice brew(1) gives you on first run?
  - glenngillen 4y ago
    I can't recall, though this approach isn't specific to homebrew. I block it permanently at a network/process level rather than having to remember to set a ENV var.

nicbou 4y ago

You know, as the law requires in the EU

st3fan 4y ago
That is not actually how the GDPR works. Anonymous telemetry without PII does not need any consent.
Xylakant 4y ago
That is a very simplifying view of the legal situation and that's not helpful at all. First, it only applies if you collect PII - depending on what they collect, they might not be subject to the GDPR at all. Second, informed consent is only one of the options that allows collection and storage of PII. There are various other reason that allow collection and storage of PII, among them "Legitimate interest". For example, it is considered legitimate to store webserver logs containing PII (IP Addresses) for purposes of fraud analysis, unauthorized system access etc. Whether a specific collection of data is legitimate under those clauses depends on the specifics of a case (who has access, what's the exact purpose, how long you store, ...) - ask a lawyer if you need an assessment. Depending on what they log and how they log, they may be either in the clear or in a bad place, but it's definitely not as simple as "the law requires no logging".
- jeroenhd 4y ago
  The analytics page describes them tracking information across time with a unique user identifier. They claim that identifier doesn't identify you, but it's attached to an exact Brew install so it does track your personal account on your machine at the very least; I'd classify that as PII. Had they not submitted unique user tokens I think you mag be right. However, that's not how the analytics seem to work. The law does allow logging for a variety of things but in this case I'd say they're in the wrong. They assume that it's okay because they don't track you across websites and that's good to know, but that's not the point.
pimterry 4y ago
I don't think that's true - AFAICT there's no EU law banning analytics. EU law just restricts storing & processing _personal_ data (GDPR) and storing unnecessary data on machines without consent (ePrivacy/'cookie law'). If you want to log fully anonymized data, without persistent tracking ids and without leaking personal data to 3rd parties en route (so no "send it to Google and they promise to anonymize the IP afterwards") then you're all good (but IANAL!). The only reason you see all those cookie notices and GDPR consent requests is because so few companies are willing to accept even the tiniest tradeoff in their metrics to protect their users' privacy.

eesmith 4y ago

FWIW, it gives you a warning and the chance to disable analytics before sending any analytics. https://docs.brew.sh/Analytics https://docs.brew.sh/Analytics > Homebrew gathers anonymous aggregate user behaviour analytics using Google Analytics (until our in-progress migration to our own InfluxDB). You will be notified the first time you run brew update or install Homebrew. Analytics are not enabled until after this notice is shown, to ensure that you can opt out without ever sending analytics data.

prepend 4y ago

I feel the same way. I think it’s not cool when orgs track telemetry with opt out. But it’s not cool like when you’re at a party and you go off and fart in the corner as no one’s there and then a few seconds later someone walks by and smells it. Continuing the analogy, telemetry with no opt out is like farting silently amongst a group of people. And tracking identified user requests while selling data is like slapping each person at the party while farting in their face. And I guess opt in telemetry is like holding in your fart and people notice and might feel some discomfort at your discomfort.

notpushkin 4y ago
What.

macintux 4y ago

Agreed, I was shocked when I installed the Dart programming language and found out it sends analytics by default. A programming language!

orangepurple 4y ago
An implementation of a build system for a programming language