hexa-Feb 15, 2025

If you're using #devenv for your projects, please note that the new `generate` command in 1.4.0 uses your repository content.

It tars up all files it can find through `git ls-files -z`鲁 and exfiltrates them to the service.

It handles `DO_NOT_TRACK=`鹿 by sending that intent along虏 as a query string, so now you need to trust the service to not keep data.

馃У 1/n

[1] https://github.com/cachix/devenv/blob/6c987a8795eedea872afe4d1c1ac518d0c7f6db1/devenv/src/cli.rs#L202-L204
[2] https://github.com/cachix/devenv/blob/6c987a8795eedea872afe4d1c1ac518d0c7f6db1/devenv/src/devenv.rs#L212-L214
[3] https://github.com/cachix/devenv/blob/6c987a8795eedea872afe4d1c1ac518d0c7f6db1/devenv/src/devenv.rs#L226-L257

devenv/devenv/src/cli.rs at 6c987a8795eedea872afe4d1c1ac518d0c7f6db1 路 cachix/devenv

Fast, Declarative, Reproducible, and Composable Developer Environments - cachix/devenv

GitHub
Show threadJoshix

@hexa i mean it seems to be an ai-as-a-service command. The files aren't only for telemetry. They are used to provide this (stupid) service. If the command was documented properly and it told people that it just uploads your files to some service, it would be fine. I wouldn't use it, but it's not different to Copilot and other ai crap using APIs.

The only way to handle telemetry with this is to send the opt out info to the server. They than could respect that on their server and not collect telemetry.

The pr that added the telemetry option: https://github.com/cachix/devenv/pull/1700

`devenv generate` by domenkozar 路 Pull Request #1700 路 cachix/devenv

GitHub
Feb 15, 2025 at 6:07pmWeb