Hacker News Reader

Parent Full thread

ARandomerDude

> When our package managers weren't linked to data aggregators watching our every move?

I haven't heard of this before (other than TFA's bare question-raising). Do you have an example?

View on HN

Same here. Doesn't even sound like a problem, it's not like you have to make an identifying account to access it.

I'd imagine having the data lets you detect/fix issues faster and flag malicious packages much easier.

Golang out of the box aggregates and analyzes usage metrics of modules whenever they are downloaded.

Which package management system doesn't do this?

On top of my head: CPAN and Debian's since both are distributed with mirrors not controlled by the the main project. It is possible that some mirrors save statistics but there is no aggregation of it. But, yes, most package manager servers track download statistics and as long as they throw away the IP addresses I do not see any harm.

True, I quickly checked

https://rubygems.org/

https://www.nuget.org/packages

https://crates.io/

... they all show download statistics of their packages.

Which also serves a useful purpose for devs, it's an easy way to avoid typosquatting by making sure you're not looking at a package with a similar name to the one you want but with only 2,000 views instead of 2,000,000

As long as they only store aggregates I cannot say that I see that issue.

Reply on news.ycombinator.com