Hacker News Reader

Comment by iRobbery | Hacker News Reader

Oh nice, just upgraded everything yesterday.

Side note: I find it a pity brew upgrade webcalls google analytics.

You can disable it if you aren't comfortable with it (they document this clearly multiple places).

       analytics (on|off)
              Turn on/off Homebrew's analytics.

I've been using brew for years and wasn't aware that it was using google analytics at all. It may be clearly documented, but they're not doing much to ensure users know about it.

There was an announcement[0] a couple of years ago that certainly provoked a lot of debate on HN[1].

[0] https://github.com/Homebrew/brew/blob/master/docs/Analytics.... [1] https://news.ycombinator.com/item?id=11566720

I guess I didn't happen to check HN that day :(

It told you on cli after you updated.

IIRC, it's mentioned when you install brew

I never noticed it. A lot of text scrolls across the screen during the installation.

what do you want them to do?

Ask for permission - opt-in not opt-out.

The current behaviour isn't sufficient for the new GDPR requirements coming in May. Contributors and any relevant companies (or their subsidiaries) in the EU could be liable.

GDPR covers personal data, not anonymous unidentifiable stats.

You are incorrect - this is personal data and does fall under the extremely wide scope of GDPR, which is simply "processing".

Under the current data protection laws, as long as it isn't personally identifying, it would fall out of scope. Under GDPR, it is in-scope, and explicit opt-in consent is required for both collection and for the things you want to use the data for.

Requiring opt-in to use the software is also not permissible.

GDPR is a bit of a beast.

At first install, prompt the user to opt-in? Occasionally re-prompt a user, say, once per year to choose to opt-out if they’re opted in, just to check they’re still cool with it and haven’t forgotten and/or changed their mind on how comfortable they are with the practice? People’s opinions on that sort of thing don’t always remain static.

Opt-in is a decent enough method. But "Occasionally re-prompt a user" is a horrible idea, in my opinion. From a user perspective, that's kind of like the software forgetting the options you set. The very first time that something re-prompted me about something I had already opted-in to or out of, I would feel intense rage that it's asking me something that it had already asked me.

You would feel intense rage? Jesus. That sounds like intense overkill. You might be quite unlike an average person if you specifically--and without fail--recall every choice you've made forever when you're in the process of setting up tools.

No, it's not at all like the software forgetting the options you've set. It's the software, in the interest of providing a user with the greatest possible control over their software, while having the average user's propensity to forget minor details in mind, offering the explicit option to re-evaluate a prior choice in the future without having to remember to do so, or manually recall the way to do it.

Moreover, when I threw out the off-the-cuff idea to occasionally re-prompt, I set that occasion as an annual one. You're making it sound in this overreaction as if I suggested it to occur every few days or weeks. Instead of instantly going to such unwarranted extremes as full-on-intense-rage-mode-11, thinking to yourself, "Oh my fucking god, what the fuck is wrong with this developer that s/he'd dare to ask me this question I answered 2 years ago again?!", you might pause just a moment to consider it to be a little like recalibrating a tool that's been in use for some time. Few people keep static positions on things. Such recalibration doesn't need to occur at every minor upgrade, but perhaps major upgrades might want to ask the user to review their settings/choices.

I've changed my position on things I've opted in/out of at various times. When it's privacy-related, I've increasingly developed a harder default stance over the last 15 years. I wouldn't mind if my tools asked me to annually review old choices I've long forgotten--much like I've heard Facebook offers people their little privacy checkups (ignoring for the moment the efficacy of such a checkup when everything you do is tracked). Many people other than me reacted to the way in which the analytics "feature" was included in homebrew with surprise, because many of us never noticed the notification, and a great many of us believe tracking is something that should always be opt-in, not opt-out. However, as of this writing, I can't recall exactly what my current homebrew setting for analytics is, and I can't recall how long it's been since I last checked it to ensure it is what I think it is.

But hey, that's just me, friend. I can't remember every choice I made last month, much less last year, two years ago, or any time before that. If you do, that's cool. If you were using a tool I created/maintained, and I wanted to cover all my bases, I'd simply give you a way to say, "Don't ever fucking ask me this question again or I'll rage tweet what a forgetful little shit you are." :)

I stand by my intense rage that I would feel if some software I was using asked me a setting question that I had already set (for no reason other than the length of time since I last answered the question). Sorry, but I'm particular about my user experience. I'm not arguing anything for or against the privacy concerns, as I do not believe the fact that this is a privacy setting means it should be treated differently than other settings.

I guess I should have gone into specifics about why I don't like that idea... I can think of lots of things that let you set a setting and say "never ask me again", but those aren't quite the same. They're usually for things that get asked _every_ time you run those programs, so until you select "never ask me again" you're not actually setting the setting, you're just giving a temporary answer for that one use. Notice how this differs from what you've suggested (asking you based on an arbitrary time period). Your suggestion is a different paradigm than the already existing ones. I can see a case for having it ask you if you want to be tracked each time you run homebrew, or each time you upgrade homebrew, but doing so based on an arbitrary time-based interval (be it days, months, or years) seems odd and needlessly different than the existing accepted UI paradigms.

Oh, and I'm not sure Facebook's privacy check-ups is the best analogy. I always thought they did the check-ups when they've specifically changed something and need to give you the option to opt-out of the change, not as a friendly "do you still want your settings this way". Maybe I'm wrong about that, but that's what it always felt like to me when I was using facebook more, since I'd see a lot of articles/blog posts about new changes, and then the next time I logged in I'd get the privacy check-up.

If you are a user who cares about such things, I think the onus lies on you.

If it is clearly documented that should be it. Maybe a blurb on the main page about it would be nice but not necessary.

Any opt-out features should be disclosed to the user on install. That seems fairly straight forward to me.

Which, as someone pointed out in a separate comment thread here, Homebrew is already doing. I'm not sure what else you want from them, they seem to be following best practices here.

Existing installs were not prompted. You had to catch it in the patch notes, IIRC.

Not prompted but were notified.

The notification when it first came out wasn’t really noticeable for a tool that frequently has a lot of output an average user running `brew upgrade` would be used to ignoring. Prompting would have been the better choice. I didn’t notice until the change hit HN and created a bit of a shit storm.

PS: Despite my feelings of disagreement on how brew handled this, I still appreciate your work.

Homebrew literally never prompts for anything so a prompt would likely break many scripts.

You are right. If I put more thought into my comment I would have urged them to prompt the user. But I rushed, and the post was invalid and senseless.

I feel that if you're collecting data about me and sending it to a third party, there should at least be a clear notice during installation. It should really be opt-in, but at the very least it should be as obvious as they would make it if it were opt-in.

There is a clear notice during installation.

That would turn it off for package downloads, but not for the initial install, right?

Out of curiosity, would you be more comfortable if brew webcalled a different service? one not affiliated with Google?

Not sure about him, but I personally would, yes.

Well different, i would prefer it would make only calls to services that are required for what the application does, so sites' project i guess is okay, but certainly not third parties. And then certainly not any big data third parties. I'm quite sure, there are download stats for the brew application itself to monitor usage and so on.

Though i had the option to block it, using little snitch (great app, not affiliated). For web browsing i have it on never allow already, but not for all applications i use from terminal, so the little snitch, snitched about it.

We do not have the resources to be able to host something like this ourselves or we would have done so.

Reply on news.ycombinator.com