CLI command analytics

[ashleygwilliams]

the download counts on crates.io were never a really great way to see how often wasm-pack is used, since you only need to download it once per version. now that we have an installer, we have even less insight into this download count.

i'd like to have analytics of some sort so we can see adoption. i also don't want to use some sort of evil service. any thoughts? my naive thought is google analytics on the website with a measurement of folks following the download wasm-pack call to action.

i was at npm when analytics for the cli tool was added, that would give us more insight into how often the tool is used. that might be a bit out of scope for this, but if people have thoughts i would welcome them here.

[mstallmo]

Generally I'm a huge fan of non-evil analytics so I think this is a great idea!

I think starting with more accurate download analytics from the wasm-pack site is the best way to go and then follow up with CLI level analytics if we feel like we need more. I could see some people being put off by having a tool collect data on their usage even if it is super benign. Analytics always seems to open a huge can of worms when it comes up and I would hate for that to detract from how awesome wasm-pack is.

[ashleygwilliams]

@iarna and @zkat (former npm buddies) - do you have any insight or lessons learned from when you did this?

[zkat]

We never really got around to doing anything with them because it needed more dev on the registry side and that work never got scheduled :( Rebecca might have more insights on that.

[iarna]

There were the very basic opt-in crash-rate data, which were being stored in S3, but we never got around to pulling the data back out. Possibly more useful is the approach we took to audit data, which I went to some trouble to make impossible to infer private information from--anything not hosted on the npm registry was hashed in a non-reversable way (that is, with a one-time session key), such that npm's servers could never learn anything they didn't already know.

Overall, I think people are actually pretty ok with this stuff, you just have to take care to be very explicit about what's being sent and always be looking at it in terms of "if all of this data were going to an attacker, what would they learn?" Having these discussions in public, and publishing documentation on both the data, and the mitigations, quell most of the fears.