How to opt out of showing the (ad) banner?

[ampaze]

Deployer Version

7.5.12

Target OS

Does not matter

Which PHP version are you using?

PHP 8.4

Content of deploy.php or deploy.yaml

No response

Steps to reproduce

Deploy something, and you get

Hello, how are you? I'm the creator of Deployer.

I hope, I do not distracting you much. I'm starting a Hacker News-like website
about tech and computers. And I'd like to invite all my Deployer users to join:

https://crow.watch/join/deployer

Thanks,
Anton

[vaites]

You can disable it using the undocumented DO_NOT_SHOW_BANNER env variable.

I think users must be warned about this behaviour at least on the getting started doc page.

[antonmedv]

Yes, you can disable this message via DO_NOT_SHOW_BANNER env var. We should update docs and add info about in on getting started page. We also need to check for other potential env vars we may missed.

[vaites]

Starting a debate about ‘it's my project and I'll do what I want’ will surely lead nowhere, but I think you should consider that an open source project should not be managed based on personal criteria, but with the aim of helping the community, and this does not do that. Because this is about trust: I have been using Deployer for years and until today I did not know that this tool makes external telemetry calls and obtains banners to show to the user because none of this is documented! Haven't you considered that anyone could now think something like, ‘What's to stop an external call from executing code on my development machine or on my servers?’.

It's perfectly respectable to have personal ambitions or projects that generate income and everything else you want, but I believe that the place to promote this should not be in the tool's output, but in the README.md or in the project documentation.

On the other hand, I agree with @ampaze, a new version check call should not be made unless it is run as a standalone PHAR file, as many of us use Composer to install the package.

[jonkratz]

Where do we set this env variable when installed globally with Composer? I've tried setting in local directory where the deploy.yaml lives, and I've tried setting in my shell profile — either way the banner is output.

[ampaze]

How about removing show banner, which has nothing to do with deployer. It even gets the content from some random other domain. You could even call it a security risk, if for some reason you lose control over that domain. Requesting and printing random data from random domains is a no go.

I have seen the env variable, it is not a solution. Seems more like it was put there only to enable you to say: "oh yeah but you can disable it". Whichs is exactly what happened. Nobody wants to define variables when calling dep.

[ampaze]

Good point, the deployer.org update check should also not be called from within a deployment context. Composer is fine for version management, there is no need to do it yourself.

You are of course free to advertise here on Github or on deployer.com but showing your ad in a deploy context is crossing a line. As I have figured out by now, you are not going to change it. But at least now you know that not everybody is okay with that behaviour.

Deployer is a good tool, but this made me have a closer look what it is doing behind the curtains. Which is probably a good thing.

Considering that Deployer has a lot of access to servers, it is a prime candidate for an attack to get onto those servers.
The XZ almost catastrope comes to mind. Which is why, in my opinion it has to be held to a higher standard.

[antonmedv]

But at least now you know that not everybody is okay with that behaviour.

I totally understand that. But this is my tool, and my reputation.

Which is probably a good thing.

This is really great! It is very difficult to encourage people to review the code today. I will be very please if you could review Deployer codebase from the security point of view. As I understand, printing to stderr is very much secure (no code execution path).

[AWqxKAWERbXo]

Coming up next: Prompt Injection via Terminal Ads.

I totally understand the wish and need of communicating with users. Just like every other company that uses Ads. I also do this.

But then don't ask me how I am and keep it one line. And don't call it anything else than advertisement.

[antonmedv]

And don't call it anything else than advertisement.

It is an advertisement. Just shaped like "email".

[AWqxKAWERbXo]

Thanks for your perspective @antonmedv

Maybe you made the point clear for me: I also don't want to recieve "emails" while deploying a project on a live server.

It's a wolf in sheep's clothing.

[antonmedv]

Also please stop changing the title of the topic, I am not asking you how to opt out, I am asking you to stop abusing your open source tool as a personal ad agency.

I see you request. Okay.

[itspriddle]

This also introduces new default behavior that breaks using the output of a task in a script.

For example, I have a deploy:pending task that returns a formatted list of commits using git log ....

I use the output of that task to pipe to another script to send myself a Slack message. The banner change breaks that.

Mine is a trivial example, and the fix add the env var or use dep ... 2> /dev/null does work. However, I would argue that if this ad stays in place it should not be emitted when being piped.

FWIW I will echo what others said here about this being an erosion of trust. I've used deployer for years and have even trained dev teams on how to use it. Yes, like mentioned above, I should have seen the banner addition to the source code years ago. Still, waking up this morning and having to work around an advertisement to deploy my app has really tainted my trust in deployer.

I do truly appreciate everything you've done for the community. You are free to do anything you want with the project, of course. I hope you will reconsider your approach to this so that users do not need to worry about undocumented behavior and HTTP calls in a mission critical tool that deals with sensitive data.

[antonmedv]

3rd party involvement during that process.

This is literally not third party. The ad was directly from me =)

[jonkratz]

The ad was directly from me =)

This isn't about not trusting you. By 3rd party, I mean a party outside of the development computer, git repo, and server. It feels like a departure from before.

[antonmedv]

I see. But I think it should be understood, what by using Deployer, you do trust me. Deployer is not the only open source tool I maintain. My tools used by millions (yes, i calculated this recently) of devs around the world. So i very caution about security.

[jonkratz]

Again, this isn't about trusting/not trusting you. I agree that use of Deployer is an indication of trust, and I feel it is a well-deserved trust for what you've built. You should be able to advertise other products using your open source tools if you like. I was referencing the timing of the ad in discussion happens at what some may feel is a sensitive operation—deployment—versus having an ad or call to action on an update, for example.

Again, this is something you've built, and if you want to run ads you can, but I think the discussion here is simply regarding when the ad/note/CTA is appearing.

All said and done, my thanks to you for what you've built and made available for so many.

[antonmedv]

I see the point. Thanks!

[antonmedv]

I removed the banner.