News for hackers. Stuff that matters.
Re:Brew commands send data to Google Analytics by blub on Friday November 25, 2016 @04:21AM (#13035349)
The US approach to privacy is "let the market sort it out". It has sorted it out by transforming the internet into a giant spying machine sucking up contacts, photos, documents, videos, metadata, what packages you use, when where and how you exercise, everything

The EU approach to privacy (eroded by lobbying and lack of control over US companies) is that citizens have a right over their information. They can ask what personal information a company has on them, ask that it be corrected or deleted. This has resulted in companies that are more careful with data.

Whenever I read a post like yours I immediately think of so-called "useful innocents", to put it euphemistically [1]. Fighting for a non-goal of better open source through analytics (get real), corporate dominance and fewer rights for individuals.

Companies don't need analytics to improve software. They certainly don't need analytics from Google, the leading spyware-as-a-service company in the world.

I expect open source to become better through writing quality software, engaging with users and if need be doing some surveys or organsising other reach-out initiatives in the open. Not analytics turned on by default but it's-ok-cause-we-tell-you-we're-fucking-you.

[1]: https://en.m.wikipedia.org/wiki/Useful_idiot

Re:Brew commands send data to Google Analytics by pvinis on Friday November 25, 2016 @04:51AM (#13035500)
Do you use brew? Have you contributed code to it? Have you installed something using brew, before updating brew for a while?

For me, my answers are yes no yes. A while ago, you did that, and you get an old version of the thing you just installed. With analytics, they saw that many people forget to update before installing after a while, so they added an update step in that case.

I call that progress, no matter how small. I didn't change that and to you didn't change that. The brew devs changed that. Maybe they would have changed it anyway later.. Who knows. But the fact that brew because a tiny tiny bit better because of analytics, in part from me, makes me a happier user. Now I don't need to remember to update before installing.

Of course it's not the best way to "contribute", but it's something. Definitely better than "contributing" your data to companies, like you said.

Re:Brew commands send data to Google Analytics by majewsky on Friday November 25, 2016 @05:01AM (#13035546)
I can totally see the benefits of telemetry. But it would be way less phishy if it were opt-in, or at least opt-out with a very visible information message.
Re:Brew commands send data to Google Analytics by CJefferson on Friday November 25, 2016 @05:49AM (#13035789)
The problem with this is, do you want every program you ever use, to start prompting you with a series of questions about various opt-in / opt-out questions? I get annoyed enough that gnu parallel keeps asking me about citing it, and that's one program.

    Bash would like to record analyitics. y/n/more information
    > y
    > ls *.c
    ls would like to record information about how you use it.
    y/n/more information.
    > y
    file1.c file2.c file3.c
    > grep 'string' *.c
    grep would like to record some information about your
    usage. y/n/more information.
    > y
    file1.c:8: string
    > vim file1.c
    vim would like to record information usage, to help
    improve vim in future. y/n/more information.
    > y
    The 'C' package in vim would like to ...
Re:Brew commands send data to Google Analytics by Nursie on Friday November 25, 2016 @06:49AM (#13036041)
No, I want every program I ever use not to leak data about me all over the internet.

I'm amazed we're even having this discussion

Re:Brew commands send data to Google Analytics by TeMPOraL on Friday November 25, 2016 @11:38AM (#13037871)
If I saw something like that, I'd format my drive and install another OS.

The very idea of your shell or file listing program sending analytics to the mothership is ridiculous. They shouldn't be even talking to a network directly. They have a set of well-defined tasks, and spying on you is not one of them.

Re:Brew commands send data to Google Analytics by tunap on Friday November 25, 2016 @11:38AM (#13037875)
"The problem with this is, do you want every program you ever use, to start prompting you with a series of questions about various opt-in / opt-out questions?"

Simple answer, Yes.

It would lead to conversations about the elephant in the room. It also alleviates the assumption I trust all providers(comprehend the EULA/ToS) and puts their actions under scrutiny. If more people realized what data is collected and by whom for whom they could make an informed, cost/benefit choice. Other useful results are, what is the applicability of that data to the project, what characteristics define the 'Trusted Partners' that data is shared with and, possibly, inject some restraint into the collectors' decisions of what to collect.

edit: removed unintended paste fragment

Re:Brew commands send data to Google Analytics by sangnoir on Friday November 25, 2016 @11:03AM (#13037605)
Lol, reminds me of what macOS did[1] to me after a recent upgrade:

  $ git pull

  (long wait)

  ^c

  $ git pull

  (got distracted and had to leave keyboard for a bit)

  Can't execute program until you accept xcode license
I couldn't believe it.

1. paraphrasing the words

Re:Brew commands send data to Google Analytics by codedokode on Friday November 25, 2016 @05:57AM (#13035821)
Opt-in can be implemented other way without questions. For example, user could set an environment variable or type a command.
Re:Brew commands send data to Google Analytics by CJefferson on Friday November 25, 2016 @06:36AM (#13035975)
Then we hit the problem that if we don't push that request at users, probably a tiny fraction will turn it on.

Worse, that fraction will be the statistically unusual people who bother reading and finding such options, meaning we can't derive any statistically useful results about the user base from them!

Re:Brew commands send data to Google Analytics by TeMPOraL on Friday November 25, 2016 @11:35AM (#13037852)
Frankly, that's your problem. I don't see even a true desire to make the software better as a legitimate reason to exfiltrate data from people without asking.
Re:Brew commands send data to Google Analytics by codedokode on Friday November 25, 2016 @07:01AM (#13036096)
Maybe you should ask them better. For example you could ask for help on the home page of your project or in the beginning of a tutorial. Or maybe they do not want to paticipate. Is it right to ignore this and turn analytics on by default?
Re:Brew commands send data to Google Analytics by lewiseason on Friday November 25, 2016 @08:23AM (#13036527)
The Debian installer gets this right: it prompts you during the install whether it can collect information about installed packages for popcon[1]

[1] http://popcon.debian.org/

Re:Brew commands send data to Google Analytics by majewsky on Saturday November 26, 2016 @08:01AM (#13043285)
I never understood why popcon is necessary. Couldn't you achieve about the same result by just counting downloads on the package mirrors?
Re:Brew commands send data to Google Analytics by smonff on Friday November 25, 2016 @06:13AM (#13035885)
Oh, no!
Re:Brew commands send data to Google Analytics by codedokode on Friday November 25, 2016 @05:27AM (#13035674)
Opt-out is what commecrial companies do because they do not respect their users' privacy. Free open source software should do the opposite.

By the way I think that browser history should be disabled by default too.

Re:Brew commands send data to Google Analytics by TeMPOraL on Friday November 25, 2016 @11:40AM (#13037892)
Browser history is useful to user (but maybe the access to it could be restricted by means of authentication). I'm fine with off-line browser history that's accessible only to the user (and not JS running on a website). But sending any of it over the wire should definitely be opt-in.
Re:Brew commands send data to Google Analytics by codedokode on Friday November 25, 2016 @12:24PM (#13038268)
An unexperienced user might not know that the history is recorded and later can be accidently seen for example by other member of the family. A good software would not allow that.

I remember some IM app for linux had history turned off by default. I was really surprised then.

Re:Brew commands send data to Google Analytics by hyperbovine on Friday November 25, 2016 @07:07AM (#13036126)
Come now, a bajillion other software projects have "figured out" that people forget to update everything, always, without resorting to this sort of behavior. There's even a whole library, Sparkle, the exists just to solve this problem. Your nonexample of the necessity of analytics merely serves to reinforce the point you are trying to rebut.
Re:Brew commands send data to Google Analytics by _b8r0 on Friday November 25, 2016 @05:02AM (#13035553)
Why do they need to use Google Analytics and hand information over to a third party instead of using something hosted?

I get that there may be money involved, but presumably self-hosting also gives them more of the information to build out what they need.

Re:Brew commands send data to Google Analytics by emartinelli on Friday November 25, 2016 @05:14AM (#13035609)
In another comment in this thread by @mikemcquaid (Homebrew lead maintainer):

> (...)and have been trying to find people who will provide us with non-Google hosting but: we're chronically understaffed and underfunded[1]

[1]https://news.ycombinator.com/item?id=13035438

Re:Brew commands send data to Google Analytics by karmacoda on Friday November 25, 2016 @05:47AM (#13035776)
What are the estimated costs for (something like) this?
Re:Brew commands send data to Google Analytics by pvinis on Friday November 25, 2016 @05:09AM (#13035587)
I agree completely with you and majewsky below.
Re:Brew commands send data to Google Analytics by Chris2048 on Friday November 25, 2016 @05:57AM (#13035818)
The issue here is not contribution, but forced/unnanounced contribution. Would it be ok if I steal from your wallet to contribute to Homebrew?
Re:Brew commands send data to Google Analytics by wfunction on Friday November 25, 2016 @04:33AM (#13035405)
> The EU approach to privacy (eroded by lobyying and lack of control over US companies) is that citizens have a right over their information. They can ask what personal information a company has on them, ask that it be corrected or deleted. This has resulted in companies that are more careful with data.

More like, this has resulted in things like nonsensical "Cookie warnings" that only waste the user's time.

Re:Brew commands send data to Google Analytics by blub on Friday November 25, 2016 @05:09AM (#13035584)
That cookie warning is just a friendly reminder that you are being tracked everywhere.

Of course, websites that don't track their users are exempt: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm

I guess the EU didn't expect websites to cling to tracking cookies like their lives depended on them.

Re:Brew commands send data to Google Analytics by Isinlor on Friday November 25, 2016 @06:34AM (#13035970)
Cookie law is one of the stupidest laws that EU forced. I had to install additional rules to adblocker to get rid of this nonsense and it still doesn't catch everything and keeps irritating me... I don't care, damn it! http://nocookielaw.com/
Re:Brew commands send data to Google Analytics by kuschku on Friday November 25, 2016 @08:35AM (#13036617)
Is it truly?

The law is pretty simple: If you track users, or transmit information to third parties which could track the user, you have to get the user to opt-in.

The original intention was to get rid of Facebook’s shadow profiles, which it did – in the EU, websites don’t embed Facebook’s like button anymore, but have a two-click solution, where you have to click it, then it’s actually loaded, then you can like.

That alone is worth such a law.

Re:Brew commands send data to Google Analytics by Isinlor on Friday November 25, 2016 @02:04PM (#13039061)
It is not worth it. I would really want a good way to protect myself as an Internet user from this law that the EU is enforcing on me. To protect myself not from Facebook, not from Google, but from the EU. It also gets in my way as a web developer. The law is not simple. 100 words sentences of law jargon are not simple. Many, many pages of such sentences is the opposite of simple. To be honest I have never really understood the law and I don't think I ever will. Even keeping track of it is far from simple.

But according to this website: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm Cookies clearly exempt from consent according to the EU advisory body on data protection- WP29pdf include: (...) third‑party social plug‑in content‑sharing cookies, for logged‑in members of a social network.

So, I think what you say about Facebook is not true.

Re:Brew commands send data to Google Analytics by kuschku on Friday November 25, 2016 @02:18PM (#13039148)
> for logged‑in members of a social network.

I was talking about non-logged in users. The shadow profiles.

> The law is not simple. 100 words sentences of law jargon are not simple. Many, many pages of such sentences is the opposite of simple.

The German version of the law is just as simple to read as any newspaper or book you read in German high school, so at least I haven't had an issue before.

Re:Brew commands send data to Google Analytics by DonHopkins on Friday November 25, 2016 @04:37AM (#13035422)
Not entirely. I've learned to read the word "cookie" in many different languages.
Re:Brew commands send data to Google Analytics by Semaphor on Friday November 25, 2016 @04:51AM (#13035498)
It has resulted in a lot of good things. Cookie consent is most certainly not one of them.
Re:Brew commands send data to Google Analytics by EvilTerran on Friday November 25, 2016 @06:49AM (#13036040)
IMO, the intent was good... but yeah, the implementation is a grand demonstration of what you get when legislators don't understand the technology they're regulating. It would be far better if they'd required browsers, not websites, to show the notifications - much like they already do when a site wants to access your webcam/mic/location/etc[0]. That would mean much less implementation work (once per browser instead of per site), no way for underhanded sites to use cookies without the user being notified or despite the user declining them, consistent UI across all sites...

Such a thing could provide significantly more useful information, too - I envisage a notification with "This site wants to use a cookie on your computer" at the top, "allow/deny, now/always" buttons and a "What are cookies?" link at the bottom, and a user-friendly breakdown of this particular case in between, things like:

• "only visible to this site" vs "visible to ad.doubleclick.net" etc - maybe including, say, the Organization Name from the cookie domain's SSL cert, at least in the case of cookies set to "Secure" (maybe only if the cert's EV)

• "until you close your browser" vs "for a week" etc - perhaps with a way for the user to force session-only if desired

• possibly some kind of warning about snooping risk if the cookie's not marked secure, or not HTTP-only & 3rd-party scripts are on the page, etc

• for the case of 3rd-party cookies, it'd be possible to list which other sites have used the same cookie in the past

And so forth. The most importantant point being that you could actually trust this information - your browser has no motivation to lie to you about it, but any random site might.

[0] eg, https://i.imgur.com/NcxWz8zh.jpg

Re:Brew commands send data to Google Analytics by kuschku on Friday November 25, 2016 @08:39AM (#13036646)
The issue is: What about technical cookies?

The law allows storing session info, config options, etc without prompting. The browser couldn’t reliably test that.

Unless you’d also let login to sites be handled by the browser, akin to Mozilla’s Persona.

Damn, that’d actually be a much nicer web.

Re:Brew commands send data to Google Analytics by EvilTerran on Friday November 25, 2016 @10:29AM (#13037365)
Yeah, that could work.

Or, to look at it another way... so what if the browser pops up notifications more often than the law requires? Might encourage people to make less use of cookies for functionality that doesn't really need them, which would be no tragedy. And if your site really can't do without them, you could pop up a message explaining the situation & politely asking to be unblocked.

I suppose there'd be a danger of alert fatigue... maybe some heuristic analysis of the cookies themselves would be in order, to at least tentatively classify them as "tracking" vs "other". Eg, Google Analytics & Piwik cookies could be identified pretty reliably.

Re:Brew commands send data to Google Analytics by Semaphor on Friday November 25, 2016 @02:26PM (#13039205)
> I suppose there'd be a danger of alert fatigue...

But that's happening with the current solution as well (not to mention all those crappy sites with their modal popups that teach you to close anything opening asap anyway)

Re:Brew commands send data to Google Analytics by codedokode on Friday November 25, 2016 @12:58PM (#13038551)
Single Sign-on can be implemented without third-party cookies and therefore without the cookie warning.
Re:Brew commands send data to Google Analytics by codedokode on Friday November 25, 2016 @05:12AM (#13035598)
Cookie warnings are an indicator showing that a website takes part in a global spying network. But I think instead of warnings browser developers should just disable third-party cookies by default. Sadly, the most popular browser developer by conicidence owns a popular tracking service so that is not going to happen.
Re:Brew commands send data to Google Analytics by lewiseason on Friday November 25, 2016 @08:27AM (#13036544)
> global spying network

Or maybe they want to persist session information?

Maybe browsers should prompt, instead of each website, but it's too late for that now.

Re:Brew commands send data to Google Analytics by kuschku on Friday November 25, 2016 @08:38AM (#13036633)
> Or maybe they want to persist session information?

That’s specifically exempt from the cookie law: Any technical cookie – session information, config options, etc – is allowed without any request.

The Cookie law only requires opt-in for tracking. Such as Google Analytics.

Re:Brew commands send data to Google Analytics by lewiseason on Friday November 25, 2016 @09:22AM (#13036879)
Yeah, good point. I couldn't recall if it was third-party cookies, or if it were tracking cookies that the requirement stated.
Re:Brew commands send data to Google Analytics by dbg31415 on Friday November 25, 2016 @06:31AM (#13035955)
> Companies don't need analytics to improve software.

I was with you except this line. Data is needed to make better choices and prioritize improvements. How would you like people to collect data? Google Analytics is free, easy, and powerful. Adding the cost of buioding a KPI tracking and reporting later from scratch... simply would be too much for most open source projects.

Re:Brew commands send data to Google Analytics by kuschku on Friday November 25, 2016 @08:31AM (#13036582)
Do market studies?

Take a dozen, or two dozen, users and give them your product, let them use it, and get far more results from that?

You can even do these things for free, especially in open source many of your potential users are willing to do this.

Re:Brew commands send data to Google Analytics by cm2187 on Friday November 25, 2016 @04:38AM (#13035428)
It's the combination of companies gathering ever more personal data and companies proving to be absolutely incapable to prevent leaking personal data that I find worrying even more than the direct spying.
Re:Brew commands send data to Google Analytics by vsl on Saturday November 26, 2016 @07:29AM (#13043158)
The EU approach of “let’s regulate everything and let incompetent out of touch bureaucrats write the legislation” left to annoying (much more than ads for me) cookie banners and other such nonsense. Starting next year, cookies — i.e. often random nonsense numbers — will have to be treated as personal data in EU. I envy US.