[parhamn]

> There's no expectation of privacy when you send data to a server. There is when you run local software.

To engage on this point: Brew is server software (most installs happen via 'bottles'), no? Presumably most package distros keep track of which packages are installed and how often (e.g. Pip/NPM even publish their data). Even if you install from source github/mirrors/etc they have that data too. I'm sure the same is true in nix too? Curious how you categorized "brew" as not server-y software? And how nix possibly gets around the mirrors/code-distribution services from having access to similar data?

Though my point is mostly moot if you point to a place in the brew source code that is taking more personal information from my computer that a load balancer wouldn't have access to.

[sneak]

> Presumably most package distros keep track of which packages are installed and how often (e.g. Pip/NPM even publish their data).

This isn’t true. Most distributions do not collect this information. There are a few package managers that do as you note, but there are also some that explicitly hide it from package publishers (the Go module proxy cache comes to mind).

Nix and the big linux distros specifically avoid collecting this information. Brew has code to deliver it to additional endpoints without consent.