If you don't believe they read the prompts closely, you're an asshole for stealing data by default.
My problem is that I believe that 90% of the users of my app won't care one way or the other if I record these stats. If I default opt-out these people, then I lose all that useful data and in the process, I believe, make my app worse for everyone.
I won't deny this is not an obvious choice, but I think personally on balance it's better to opt-in. Especially when the data is anonymised and doesn't contain any private/identifying information. But I understand how others would disagree. If there was some kind of OS-wide "don't record what I do" option I could hook into, I would use it.
Look at the outcry when Microsoft put this stuff in Win 10.
At the very least you should present a question on install. Hiding a notice amongst licenses and other information, as often happens, is underhanded and scammy.
If those people wouldn't volunteer to opt-in, it's just as likely that the reason they are not opting-out is because they missed the notification that someone is collecting data about them.
It's a UX anti-pattern to default behavior to something the users may not want. If you're worried they'll accept whatever default there is, just explicitly ask them if they want to relay usage stats and you'll be surprised how much of the 90% you claim don't care will start caring.
Look at the comments on this thread, there are multiple accounts of people surprised by this. The very fact that this article is on the front page is proof that Brew tricked users.
>Especially when the data is anonymised and doesn't contain any private/identifying information.
You've either made massive breakthroughs in the field of information security or this is a bogus statement. If the user's computer even connects to an analytics service, they've already got an IP address, frequency of connections from that IP, etc and all of the correlation that comes with enabled by their other data sets. Just because it's anonymized by the time it comes out of Google in Brew usage reports doesn't mean it hasn't given Google additional information to profile people.
I think, based on the conversation here, I'm going to make it very clear there is analytics, but not allow turning them off. This is (I think, you are welcome to disagree of course) the best situation:
* Everyone knows there is analytics going on, no hiding. * I get good quality analytics from my actual users, as no-one can opt out (well, you could start port blocking, I'm not going to make the program stop working in that situation).
Of course, that suggests we should introduce some kind of standard, then bash (or whatever shell you use) could prompt you once, and every other program could use that setting.
Unless of course you are fundamentally opposed to tracking of any kind, then a fork is required. It is a fairly massive infrastructure to recreate however...
You appear to be saying that it's wrong to send any data to Google - which strikes me as an indefensibly extreme position. For example if they were tracking a simple count "number of times anyone anywhere has run brew" and it was stored as a single global integer then it's hard to imagine what issue you could have with it as it's basically no worse than a simple hit counter on a website.
So what are you saying? Surely the problem has to relate to what data is collected?
And after all the Snowden revelations it's very naive to assume that Google (or any other company) will protect your data.
What is the threat model here?
(Also, downloading a movie is a different thing - there you're not stealing nor exfiltrating anything, you're downloading data as intended by uploader, who may or may not have the copyrights for that data.)
(INB4, ripping a DVD and uploading it is not data theft. Exfiltrating a pre-release copy from movie company's servers would be data theft.)
The sharing or getting something from a shared thing would merely be copyright infringement.
This is the usage I'm most firmly resisting.
> PII, launch codes or identities
All inaccurate to varying degrees - or at the very least metaphorical/rhetorical uses. If you're allowed to push a meaning in one direction then I'm allowed to point it out and attempt to bend it back a little.
I'm not pushing anything. Your argument is about whether or not copying information is 'stealing'. I'm just pointing out that it's a very commonly agreed upon vernacular all over many industries. Call your credit card company and tell them someone stole your credit card number and see if they understand what you are talking about and/or try to correct you by saying it was merely copied.
Go ahead and try to change the definition, but don't waste time on HN with that crap when the subject isn't even about whether or not it's "stealing" because it makes for boring conversation.
You don't think that is possibly somewhere towards the further reaches of consensus on what is a reasonable application of the word?
You're welcome to disagree with my position but you're going a touch further than that. You're also accusing me of arguing in bad faith and being somehow aware that my argument has no merits. Considering I think I'm stating a fairly reasonable view I find that somewhat disingenuous in return.
This is a prompt:
"Do you want Homebrew to enable anonymous aggregate user behaviour analytics (yes/no):"
This is not a prompt:
"Homebrew has enabled anonymous aggregate user behaviour analytics."
This avoids both the problem that the user doesn't consent with opt-out, and the problem that nobody cares to opt-in. The disadvantage is it doesn't work with unattended upgrades.
We can argue the merits of distrust and of the user's choice to distrust, but the software itself is the same.
Edit: downvoted for asking a question?
That means that you'll either get something close to 0% telemetry if it's default off, or 90% if it's default on. So, it makes sense to be default on if you want your telemetry dataset to be big enough to be worth it.
But then we get to your question - why bother with an opt out? Well, if the decision is either to use the product and send telemetry or not use the product, that 10% of people aren't going to use your product. They care about not sending telemetry that much.
At that point, as a dev you just have to ask yourself is it really worth losing 10% of your users to an always-on telemetry policy or is it OK to make the concession of allowing an opt out in order to grow your user base?
Personally, I'd rather make the concession and get that 10% of people on board. If they're vocal enough to complain the shortcomings of my product they're probably vocal enough to also talk about the good things and give me free advertising.
If people aren't turning telemetry on, do you think they really want to send you data in the first place?
What you are doing is exploiting users assumptions of how normal CLI tools behave. They don't assume it's going to relay my information back to google when I use it.
Your entire argument essentially boils down to, "I'm sure I can get away with taking my users' information by making it the default behavior with a buried notification and I can placate people who care about privacy with an opt-out."
Your entire justification doesn't even mention privacy or caring about users, it only mentions dealing with pesky users who care to get your user-base higher and promote your product. You clearly have very loose ethics when it comes to privacy so I don't think there is much we will agree on. I just hope one day this behavior will be shunned enough that it will stop due to market forces before something like the EU regulates it away.
My argument is not specific to telemetry, it's a general one. If you have an option to do something that's not a default and it's not part of the software's core functionality, most people aren't going to consider it even if it would be to their advantage. For example, make -j.
It's for that reason that I don't think the "if they aren't turning it on then they don't want it" argument holds as much water as you think it does. That argument groups together three groups of people: people that know about the setting and don't want it on, people that don't know about the setting and don't want it on, and people that don't know about the setting and would be happy if it was on.
Ironically, if you had good telemetry you'd be able to figure out how many people fall in to each group and make decisions about settings based on accurate data. Without that, you're forced to work on assumptions.
> Your entire argument essentially boils down to, "I'm sure I can get away with taking my users' information by making it the default behavior with a buried notification and I can placate people who care about privacy with an opt-out."
I think you're making the assumption that telemetry has to violate your privacy in all kinds of heinous ways and therefore only be a bad thing. If that's your mindset, of course you're going to think that I'm the kind of person that's out to trick and fool people and betray their privacy. And in all fairness to you, it's reasonable to be jaded when companies like Microsoft have horrible things like P2P software update distribution enabled by default. It's reasonable to be jaded when you don't get told exactly what kind of data is being sent back as telemetry. There's a fine line between "this is good" and "you're just relying on people not knowing how to change the defaults in order to try and get away with horrible things" and all too often that line is crossed.
But I'm an idealist. I see the good things that can come out of having telemetry. I want to know if my software has started getting popular in locales that I haven't written translations for yet so I can commission a translation to improve the experience for people in that locale. I want to know if there's a setting many people turn off so that I can consider turning it off by default to match user expectations. I want to know if my users are sticking to older OS versions because if they are I need to keep older hardware around in order to test and provide them the best possible experience.
I don't think anyone would have an issue with software sending back that data (and only that data) if you clearly tell them that's happening, and I also think that most people would be perfectly fine with that being a default behaviour. Of course, there is always going to be a group of people that will have an issue with sending back that data and that's why I made the point about keeping it as an option.
That group isn't just "pesky users who I only care about for promotion" (perhaps I was too flippant about saying that in my original comment). They could be trying to harden a machine so that it only uses the network under known circumstances. At the same time, you'd hope that software intended for use by people who need comprehensive privacy like whistleblowers wouldn't have telemetry at all.
Given that OS X isn't 100% free software, no one should be using brew in that kind of comprehensive privacy situation and so having telemetry isn't inherently bad.
It's the "clearly tell them that's happening" bit that's the issue here. If you have software that has been around for a long time that doesn't do something and then in a new release it starts doing that thing, you need to let people know that! It doesn't matter whether that's telemetry or anything else - if it's something that violates existing expectations you need to tell your users loud and clear.
I can understand why this might upset people, but for me I hope it will make brew a better product. I'm sure we all know as developers how annoying it can be to not know the problems users have, and what they are using your software for -- that's why most websites have analytics.
I'm hoping to add something similar to software I work on, with an opt-out of course. I believe it will help me serve my users better.