Comment by developer2 | Hacker News Reader

Comment by developer2 | Hacker News Reader

Parent Full thread

Man, the privacy critics really come out of the woodwork every single time "opt-out" is mentioned, regardless of the actual facts for a specific situation. The developers explicitly state they set the anonymous IP address flag. There is nothing that links back to you as a person. Are you really concerned that the developers know which packages a random, unknown person has installed?

Crying "opt-in" to every single little thing that has ever tracked you for non-nefarious reasons completely detracts from the cases where tracking is nefarious. Homebrew is not tracking for ads. They are not tracking for anything worth selling to a 3rd party. They're not - and are incapable of - linking this to any other database that does contain personally identifiable information. There's no "profile" worth anything to anybody except the developers, who are trying to get some very basic information completely detached from any identity.

>> You will be notified the first time you run brew update or install Homebrew.

>> to opt-out of Homebrew's analytics you may set HOMEBREW_NO_ANALYTICS=1 in your environment

They went to the lengths to document this. And to notify you when you run the software. You have the opportunity to opt-out of something that is completely harmless. There is no valid reason to be crying foul over this. Of all the tracking that goes on with our internet connections, this should by far be the least of anyone's concerns.

I have uBlock Origin installed in Chrome. With all the ad networks and analytics scripts blocked. Google Analytics does not run in my browser. And yet, I am not even slightly opposed to homebrew's use of it. It's actually anonymous, unlike how many developers use GA in the browser (tracking IP addresses, custom fields like user ids that link back to the site's database, etc). God speed, homebrew devs.

If all this is true then why even go to the trouble of supporting opt out?

The support for opt out acknowledges (implicitly) that the choice to upload data is rightfully the user's own prerogative. Then paradoxically enables the feature by default anyway and places the switch behind some esoteric opt out commands.

You might not support or use Google in any way. There are such people. They use DDG and go to extraordinary lengths to prevent any assistance to Google. I'm not one of those people, but the ability to turn off the feature is reasonable.

Some folks don't trust Google. There might be a case down the road where the U.S. government required access to the data due to National Security. Given how they handled the San Bernadino iPhone incident, it's not like this won't ever happen.

Others believe that Google will use the data for their own ends. In the same way other don't want Googke to become more powerful, others will be concerned that Google uses analytical data like this for their own commercial purposes, and it's not known what this might be.

It also would be a PR nightmare if this wasn't added, even though the data is anonymised to the Homebrew guys. Perception is important also. Not to mention the fact that it doesn't hurt to add this option to Homebrew.

Personally, I'll just leave it on as I don't subscribe to any of the above views, but I'm imaginative enough to see potentially legitimate concerns. :-)

I support opt-in as well. Make it the default option so people can press enter or use -y if you'd like.

I'm thinking along the lines of popcon in Debian http://popcon.debian.org/

Because they're not stupid and knew that the first thing out of naysayers' mouths would be "why is there no opt-out?!", which then gets followed up with "it shouldn't even be opt-out, it should be opt-in!". They tried to get out in front of the matter by even bothering to document the use of analytics, and implementing an opt-out mechanism at all. Unfortunately the nefarious ways in which intrusive analytics are used on the web has completely ruined the concept of gathering the most basic analytics in any situation.

They could have just added the analytics without saying anything. Which then leads to a) someone discovering the outgoing analytics request and reporting it on sites like HN, b) them having to defend the use of analytics and PR-fake-apologizing for not disclosing its use up front, c) implementing an opt-out, and then d) dealing with HN reports about it being opt-out instead of opt-in.

The privacy implications of analytics gets blown way out of proportion every time the subject is brought up. There is a huge difference between gathering basic information a la homebrew, and the way the large ad networks track and share your information across every damn website you browse. Yet there is this vocal group of people who treat them equally.

If you can't verify that Google are actually anonymizing the data then you can't claim this is "completely harmless". I don't trust Google and this requires me to. Is that unreasonable to you?

Reply on news.ycombinator.com