Overly detailed User-Agent

pip’s User-Agent field looks like this:

pip/9.0.1 {"cpu":"i686","distro":{"id":"jessie","libc":{"lib":"glibc","version":"2.19"},"name":"Debian GNU/Linux","version":"8"},"implementation":{"name":"CPython","version":"3.4.2"},"installer":{"name":"pip","version":"9.0.1"},"openssl_version":"OpenSSL 1.0.1t  3 May 2016","python":"3.4.2","system":{"name":"Linux","release":"3.16.0-4-686-pae"}}

That’s a lot of information about my system. PyPI has no business knowing my OpenSSL version, my libc version, or my kernel version. Please trim this down.

[lkarsten]

Hello.

I came across this today, and I’m very surprised that this is the case. This is a terrible default setting, and it should definitively be changed.

At the very least it must be clear from the --help text that any command run will leak details to third parties that you have no control over.

If you need analytics, make it opt in. Ask people if it is ok that this is sent. You have enough traffic that sampled traffic will be good enough for this use.

Please reconsider this horrible practice. Make it right.

[dstufft]

This information is used to provide metrics to figure out what folks are using in order to make informed decisions about where we draw lines of support for a variety of features. For example, you called out the libc version, and that is used when deciding where to draw the lines of support for features like manylinux1 and such. Removing data from this would make it harder to progress python Packaging (and is unlikely to actually be useful to anyone else, particularly since pip makes it difficult to accidentally send this information cleartext).