I’ve written up a new protocol that would allow us to estimate how many unique Pkg clients there are for Julia and for each package in a way that doesn’t allow for tracking individual users. This works as a rough proxy for the number of users of Julia and various packages, so it’s of interest for ma…

Compared to what others do for telemetry, this is super privacy-complaint! Merci!

Thanks for working on this! Just wanted to link to two prior topics of interest with respect to Julia user population estimates: [image] Pkg.jl telemetry should be opt-in Internals & Design New “ Pkg & Storage protocols ” and an accompanying centralized service …

[image] gdalle: In particular, judging from the second, it seems that HyperLogLog sampling is already being used? Ah yes, this was an early iteration of this same line of thinking, but for estimating counts of unique IP addresses rather than unique clients. Why do we have to estimate the numb…

On the RSA-based cryptographic construction: I don’t feel qualified to give real feedback. LGTM, but that doesn’t mean a lot. I feel that this would profit from being more connected to the general cryptographic literature. This feels related to oblivious transfer and to oblivious sampling (with th…

[image] foobar_lv2: I think the approach should be generally useful outside of julia, and would deserve some kind of cryptography paper. If one could find a way of doing this over elliptic curves, then this would become much cheaper. Agree, and I’d like to write up an academic paper and submi…

[image] StefanKarpinski: I’ll add both an assert and a comment. Then also add a comment that Length extension attack - Wikipedia are not an issue because of the general context. Everyone who reads crypto_hash(secret || message) will immediately pattern-match to both the fixed-size/separator i…

[image] foobar_lv2: Then also add a comment that Length extension attack - Wikipedia are not an issue because of the general context. Honestly, I’m not entirely sure why we don’t care about this aside from the fact that there’s not really anything useful that can be accomplished by the client…

[image] StefanKarpinski: [image] foobar_lv2: Since very long-time tracking is very scary, maybe decay the fingerprints / hll-tokens? E.g. each julia install gets 1% per week chance of forgetting / regenerating its fingerprints. I think this may be overly complicated. The simpler thing to …

[image] foobar_lv2: Alternatively, use sha3 Just on this note, I wonder if Keccak might actually be quite a neat fit for several parts of this construction, rather than just avoiding the SHA-2 length-extension issue. A small Keccak sponge implementation could provide: KMAC for the keyed res…

RFC: Proposal for estimating unique Julia clients without tracking

General Usage

gdalle July 9, 2026, 10:43am 3

Thanks for working on this! Just wanted to link to two prior topics of interest with respect to Julia user population estimates:

In particular, judging from the second, it seems that HyperLogLog sampling is already being used?

Topic		Replies	Views
Announcing: package download stats! Announcements package , statistics	44	9934	November 27, 2021
Pkg.jl telemetry should be opt-in Internals & Design	396	34865	August 3, 2021
Release strategy for juliac? Community binarybuilder , juliac	30	3526	April 7, 2024
Include git-tree-sha1 and giturl for registries in Manifest.toml? Internals & Design question	1	718	May 19, 2020
Some Julia growth/usage stats Community	42	13635	July 13, 2025

RFC: Proposal for estimating unique Julia clients without tracking

Related topics