I read your explanation downthread that you didn't mean anyone should do this, but the sentence as written is beyond the pale. This is not good community behavior. Please do a better job of considering other people when you post here.
Homebrew lead maintainer here. We're chronically understaffed and underfunded. We have analytics so we can make Homebrew better by figuring out how to prioritise security, maintenance and bug fixes on packages based on how much they are used and how often they fail. I've been working on making regular dumps of this data and have been trying to find people who will provide us with non-Google hosting but: we're chronically understaffed and underfunded.
One of our CI machines burnt out last night so I'm now trying to plan vacation time to drive for a 14 hour round trip and pick it up. While I'm doing that someone points out there's someone on Hacker News threatening to sue me. This is for working on software (mostly) in my free time that's used by people (mostly) for their employment and obtained for free. After the last thread on this (https://news.ycombinator.com/item?id=11566720) I had people emailing me to tell me I'm a nazi and should kill myself for weeks.
Everyone here who objects to the analytics is well within their rights to do so (and should either opt-out or stop using Homebrew) but we need to start asking ourselves as a community whether we think treating open-source maintainers like this is more or less likely to encourage more people to work on the open-source software you rely on to do your job.
If things you don't like happen with a project, start a dialogue, fork it, or use something else instead. Don't just wade in making threats.
(Sadly, this has been going on for a very long time: I remember the debacle over .NET 2.0 support in NDoc where the author had some difficult personal circumstances coupled with people constantly hurling abuse at him. Net result: he understandably quit, not just NDoc but all OSS involvement, nobody else wanted to pick up the project, and the project died. This must have been 11 years ago now but it seems like, since then, the problem has if anything become worse.)
As a long-term homebrew user, I am very appreciative of your hard work (and have even contributed here and there), but in that light I am also very disappointed that I have to manually disable analytics and now have a lot less trust in the homebrew project.
In the same way that I would complain if I were to see a bug in your code that radically effects my production, I consider this invasion of privacy - whatever the justification - worthy of complaint, too. Whatever the justification for this, its not an acceptable path to take, and I strongly urge you to consider making Analytics opt-in, and not opt-out. I have no problem with my next 'brew update' pausing, explaining the situation rationally as you have in this post, and giving me a y/n opportunity to proceed with participating in analytics. I do have a serious problem with you assuming that this is okay, not informing me of it in a fashion that makes me aware of the tracking, and just letting it slip in during an update, which I am now even more suspicious of, even though I do them religiously every week, and have done so for years.
You've just made your product less attractive to me as a developer and user. That's a sad state of affairs, and I hope you fix this bug.
Exactly this. The homebrew team has done an amazing job for the past 7 years, all free and volunteer work. People threatening with suing the maintainer are poison for the open-source community. But hey, haters gonna hate.
If I understand correctly, the data is anonymized before it is sent to Google [1]. How may people worrying about privacy download from Github using a proxy/vpn solution to hide their IP?
I've listened to the Changelog podcast about Homebrew and first learned about Google Analytics there. I think people do not realize how big homebrew is (in form of usage and traffic). At this scale, the maintainer opted for collecting data anonymously in order to find bottlenecks and improving the entire software stack. You can disable that feature in the same way you would disable cookies in your web browser.
[1]: https://github.com/Homebrew/brew/blob/master/docs/Analytics....
From a happy and grateful Homebrew user, thank you for all the work you are doing. It's really easy for folks to underestimate how much effort is involved in running a project like this. Details like the above should be a reminder that it's clearly a very significant amount of hard, sometimes thankless, work; work which you are in no way obligated to do. There are large numbers of people who owe you a massive debt of gratitude for all the time and hassle that your effort has saved them. And it's quite sad that we (people) tend not to speak up when we are happy, and only make noise when we're upset about something.
Thanks for continuing to work on this project!!
On the other hand it was likewise surprising to hear that homebrew was using github as its CDN.
I don't rely on homebrew to do anything, but I am concerned about the normalisation of surveilance and will point that out in a reasonably polite manner.
That sounds a bit weird to me. Homebrew gets developed on GitHub... so using GitHub as a CDN doesn't seem wrong (to me).
Sounds like they weren't using GitHub's Releases approach for binaries, instead doing something else. :/
Homebrew is excellent software, and the malice expressed in this and similar threads does in no way reflect (my) real world experience of people's perception of Homebrew. I would go so far to say it's probably the best piece of software that I know, it's really easy to use, always works and helpful if something goes wrong. Good software is pretty rare to find, especially open source software with no commercial backing.
I think that giving up on user's privacy is not an acceptable solution. If you don't have enough time to fix all the bugs and nobody is willing to help then nothing can be done.
What I expect from open source software is that an application should not collect and send home any data by default (I understand that it is not written in the license but still expect this). Breaking this expectation makes me and maybe not only me a little disappointed.
As we're not providing information to any commercial company or selling it I don't think this is a reasonable comparison. If we were collecting information to sell and raise funds for the project I'd object to that, too.
The fact that Homebrew uses Google Analytics means that it provides Google with more data, even if you don't hand that data over to other companies after the fact.
> It uses a randomly generated UUID that you can change at any time and we request IPs be anonymised using the documented method...
You already have a UUID. Why give Google the IP at all? Of course, I don't understand your desperate need for "analytics" unless it's a need for approval. Why can't you take all the blog posts talking about "brew" as approval enough?
Keep up the good work.
I also completely understand the need for default opt-in. I probably wouldn't check the prompt and leave the default, but for a project like this, I honestly don't mind sending usage data.
If you're not happy with the direction taken by the maintainers, find another tool.
So to answer your question, the status of the project and his personal affairs have a huge impact on design decisions.
Priority isn't a design decision.
Analytics help, but the choice to not opt-in is not excused by "but we need them"
I'm just saying that you're putting yourself on risky ground, not that I want to do something personally.
In fact I'd even consider keeping GA enabled IF BEING NOTIFIED.
The current notification is the problem, as it is close to invisble. Hiding output in a long log message is a dark pattern, I think it did not happen out of spite (you just used your normal shell output mechanism to show that).
However: Such a chage of policy is more important than the list of files being removed by git. Even opt out is OK IF THE USER IS INFORMED.
Currently it's like arthur dent being informed about the highway being built ... yeah we did display the notice.
I know building an open source project is no fun and I can really relate to your desire to know more about installations and deinstallations. Personally I don't even object to using google GA, just to the way it feels being snuck beside the radar.
That said, I still don't appreciate threats or ideas to sue me as an individual. That's a massively disproportionate threat to me and my family.
This certainly sounds like you're advocating for people to - at the very least - harass him.
* That Phone in your pocket? "No problem"
* The browser you're using right now? "This is fine"
* Your internet-enabled TV? "All good"
* Open source project collecting usage metrics? "Woah, hold on there buddy"
Get some perspective.
They're completely transparent about which very limited usage metrics they use. You can inspect exactly which metrics are sent. And you can turn off these metrics if you want.
You're not paying anything for the product, and the analytics aren't being used to target you as a consumer, or to pitch advertising at you.
Simply by reading this page on hacker news you've sent more information to a third party than you would using brew.
If you have a judge who is not completly dumb he would laugh you off for such litigation. If you have a judge who still has his staff print out internet pages for him it might get compilicated for you as a contributor. Idiot judge already happened to me, that was an expensive lesson life taught me.
So no, I wouldn't risk sticking my name on something like that.
Because everybody else does it, doesn't mean you don't get away with it. (And over here the big boys google/apple can do a lot of things the small ones can't even begin to try - they have the advantage of getting before a "high enough" court with intelligent judges)
Why?
Under European law, you can only transmit such information or track it if you have an explicit opt-in to it.
I'd doubt you'd get laughed out of court, considering the Cookie law was written for exactly this case.
If they were transparent, they would ask you before transmitting data.
Websites tracking you is expected. Local tools tracking you is not.
Also Ideally I'd suggest you should be looking for informed consent before starting to gather information of this nature where an application previously did not do it.
Something similar to Debian's request to submit data for the package popularity ratings that is provided when you install debian might make sense.
* A phone is a communications device. We know it transmits information. Unwanted tracking that exceeds the metadata strictly necessary for the execution of it's purpose and usage of this metadata for any other purpose needs to be opt-in.
* The browser is a communications application. We know it transmits information. Unwanted tracking that exceeds the metadata strictly necessary for the execution of it's purpose and usage of this metadata for any other purpose needs to be opt-in.
* An internet-enabled TV. We know it transmits information. Unwanted tracking that exceeds the metadata strictly necessary for the execution of it's purpose and usage of this metadata for any other purpose needs to be opt-in.
* Open source project collecting usage metrics? Downloading software packaged generates metadata. We understand that, and use the software on that basis. Any usage of that metadata and tracking my usage habits of said Open Source project needs to be opt-in.
You're perfectly within your right to feel conned by the data collections. I myself opted-out after I saw the message when I installed home-brew few months ago and, yes, I am a bit bummed that I have to take these extra efforts to opt out.
But threatening to sue for a completely free software that people maintain voluntarily? You're not even just saying that there is a potential for litigation, but you actually said that because they're a "nice target"?? HN mods can ban me for all I care, but I have to say you're one entitled asshole, and this kind of behaviour is the reason of why so many open source project maintainer burnt out.
Giving away something for free gives no guarantee of quality, but doesn't justify stealing analytics.
Its open source. Why not open an issue, contribute a patch to make the process opt-in, start a discussion, start a fork? Oh, of course, why would we do that when we can attack the maintainers, call their software a spyware, and threaten to sue instead? While we're at it, let's use words like "spyware" and "stealing" to paint them in an even worse light.
I, for one, loves the homebrew project, and I don't want the maintainers to burn out. There isn't much that I can contribute to the project, but calling out this kind of behaviour is the least I could do, and thats exactly what I'll do.
The maintainer already stated it's not a bug, plus the nature of the message implies opt-out was a design choice.
> of course, why would we do
Why start a fork before "attacking" the maintainer? Are you suggesting we need to audit every code base we use? As reasonable as checking every box of morning cereal for glass shards.
The software is spyware. Words like "spyware" and "stealing" are correct, I don't care how it paints the maintainer to describe the situation accurately, they created that situation.
> calling out this kind of behaviour is the least I could do
by "calling out this kind of behaviour" you attacking critics with poor arguments? That's not support, its fan-boyism.
No, that is not "correct". The aren't even tracking their user, they are tracking the use of their software. Your use of the words are manipulative and dishonest.
> by "calling out this kind of behaviour" you attacking critics with poor arguments? That's not support, its fan-boyism.
None of the things I called out are "critics". Legal threats because they live in a place that makes them a "good target"? Calling the software a "spyware" because they collect usage data? That is not critic. That is bullying.
If the people doing those things think the I'm a fanboy for calling them out, since clearly logic matters little to them anyway.
Nothing there mentions user tracking. If I don't know information about my computer is being transmitted, it's spyware.
> Legal threats
I didn't comment on this because I didn't say that.
> That is bullying.
I disagree. It is accurate, not disproportionate. Plus you misrepresent my opinion; it is not because "they collect usage data", but because "they collect usage data without your permission"; hence spyware.
> If the people doing those things think the I'm a fanboy for calling them out, since clearly logic matters little to them anyway.
In order to "call someone out" you need to argue the case, so bit early to bring out the ad-homs.
I'm calling you a fanboy because you suggested defending the author is your 'contribution' to his project, which biases your perspective.
It's the same as the "3rd party cookies enabled by default" setting on Firefox. It's the wrong default if you really care about your user's privacy as Firefox claims to do. It's hard to even find the setting unless you know where it is. And it's Google who is paying so it stays the way it is and patches that change it are rejected.
Suddenly they were met with headlines like "Mozilla/Firefox hates small business owners" and they are simply not capable of handling a publicity attack (remember the whole CEO thing?) and they caved in.
The number of sites that don't work without 3rd party cookies enabled is very small and from my point of view they are plain broken.
But the bottom line is, despite Safari already doing this, Mozilla was met with a lot of hostility when they tried to implement it, and eventually gave up.
Here's an excerpt from Computer world, that'll give you an idea about how things were unrolling back then.
Mozilla has effectively postponed Firefox's controversial third-party cookie-blocking policy for several months.
...
Months ago, when Mozilla's proposal appeared set to debut in Firefox 22, several online advertising groups, including the Interactive Advertising Bureau (IAB) and Association of National Advertisers (ANA), vehemently objected, claiming that the on-by-default blocking would "disenfranchise every single Internet user" and result in the shuttering of small businesses and small websites. An official with the ANA promised that Firefox users would see more ads, not fewer, if the feature was switched on.
http://www.computerworld.com/article/2498038/data-privacy/mo...
Incredibly shameful comment. Calling for someone to be sued, and then especially targeting someone who'd be vulnerable. Fucking unbelievable. Flagged this hard.
Man, it would be great if analytics couldn't be opted out of and you insane paranoiacs would leave the rest of us normal people alone. Went straight for the nuclear option: litigation.
Suing straight off the bat is bad, but if they refuse to so anything about it may be the only option.
*Edit: I run brew update; brew upgrade; brew clean on at least two of my three machines at least once a day, while I should be more vigilant opt-out is really something I'd expect from Microsoft or Google themselves and not an open source project such as Brew.