Tidelift ✨

Discussion on: Scarf.sh

Collapse
aviaviavi profile image
Avi Press

👋 Founder of Scarf here, happy to answer some of these questions.

You are correct that no cookie banners are needed with Documentation Insights, as it does not rely on cookies at all. It works entirely on information from HTTP headers and IP address metadata (raw IPs are purged from the system).

That principle of always deleting personally identifiable information is a major factor in keeping Scarf compliant under GDPR and similar kinds of regulations, as well as why maitnainers are not legally required to collect explicit opt-ins while using Scarf. Under GDPR, Scarf is the data processor, acting on behalf of the data controller, the OSS project, which never actually touches any sensitive data.

What we tried with scarf-js was an early attempt to get package authors this valuable data, to help them build better and more sustainable projects. While this particular usage of postInstall hooks was had no malicious intent or effects whatsoever, it was unfortunately (and perhaps not surprisingly) unpopular with end-users in the JS community. We took the feedback to heart and continue to push forward on our ideas however we can, and so Scarf has largely de-prioritized our package SDKs in favor of Scarf Gateway (about.scarf.sh/scarf-gateway). By augmenting the registry layer, Scarf Gateway is able to surface all of the same data without adding any kind of telemetry hooks or even running code on the users' machine at all. scarf-js is still in use by a handful of npm packages so we will continue to support it, but phone-home mechanisms have categorically proven too unpopular with the OSS community, and ultimately Scarf exists to help the community.

Empowering OSS developers with safe and useful analytics has not been traditionally popular, but the reality is that many many maintainers badly need it. We'll continue to listen to what developers tell us and build the best solutions we can to fit everyone's preferences and needs!

Collapse
jab profile image
Joshua Bronson Author

Thanks Avi, great to hear more about Scarf, straight from the source!

I decided to start out by trying Documentation Insights (on my bidict.readthedocs.io docs site), and I'm happy to say it's been enlightening already. (E.g. I had no idea that folks at Tesla have been reading my docs, and might be using my project!) Any plans to add a weekly email digest feature with the latest insights, in case I forget to check the Scarf dashboard for a while?

Thanks again for the helpful info you posted, and for offering such a useful service to the open source community. Looking forward to following Scarf updates in the future.

Collapse
aviaviavi profile image
Avi Press

Love that! I'm so glad to hear you're finding it useful.

Currently we do send out a weekly digest of new companies that have surfaced but that's only hooked up to package download metrics; Documentation Insights is not yet included. We'll get that added soon! Really appreciate the feedback, we'll definitely be improving those digest emails.