It is not checking that is the problem, it is sending obfuscated information about the user without disclosure. That is unacceptable in any context, let alone a tool that requires an unprecedented level of trust.
I'm trying not to be flippant (let me know if I failed), but most tools with an online connection send back a lot of information about you, with just about the same amount of disclosure (somewhere in the EULA it says they may).
Especially if you play any online games with ranked or PvP, they are likely doing a ton of work to prevent cheaters - and this information is necessarily going to be obfuscated, to delay the cheaters/hackers in their efforts to work around it.
From Anthropic's point of view, they have a class of "cheaters" they're trying to detect - people trying to distill their models. Those people are of course going to try to work around any detection, so you can't send that signal in clear-text where it is easily detected and blocked.
This isn't an online game we are talking about, it is a fundamentally different kind of application, non-deterministic and capable of manipulation. The bar is much higher. They should collect analytics if it is necessary to provide the service, but they should do so transparently. The solution to snare cheaters can't be worth the sacrifice of trust through non-transparent collection of user data. Although this particular information might not seem sensitive, if they are willing to use this method at all, they are probably willing to use it in other ways.
There's nothing wrong with the transparent collection of analytics. I expect any software that I run to tell me what they are sending at a bare minimum, and ideally give me a choice. This is the common and acceptable approach for a software company that deserves your trust. A willingness to cross that line with something small does not lend trust for something big, and there's nothing really comparable for the level of trust that this software requires.
This entire thread has lost its collective mind. Tracking time zone has to be up there with IP address and referer in the list of "trivial things every company in the entire world collects about you", and these things are entirely trackable without your consent or even knowledge. You're gonna have to turn off the Internet.
It seems like the confusion is about whether it is common practice to collect analytics vs whether it is common/acceptable practice to do so without disclosure and to cover your tracks. I recognize that virtually every cloud service collects info. Even something as trivial as IP address and region are not too trivial to include in the EULA.
What is the harm of that disclosure? If you are a company that wants to establish a firm basis of trust because you deliver a sensitive service, it is a necessity. I can't say with certainty that Anthropic doesn't disclose that they collect this info, but in any case, the way they've chosen to implement it does not lend credibility.
In your example, service providers may be allowed to collect IP address or cookies or referer which are either critical to how they provide service (IP and cookies) or part of the established norm (browser sending referer).
That doesn’t mean they are allowed to go beyond and scan user’s environment variables
Maybe you missed it in the post, they look for the value of an environment variable and send the obfuscated result. I'm guessing this particular variable isn't sensitive for most users, but the reality that they find it acceptable to snoop your environment and hide their tracks is a big red flag.
