I feel like narrowing down what any of those companies could do to what they are doing today irresponsible. And analytics is one of the could-do's that many third party tools do offer or add on later to increase monetization or perceived value to customers.
The important point is that there are now 8 attack surfaces instead of 1. Whether they're analytics or pad-string doesn't really matter.
I agree there are now 8 attack surfaces, but to call all 8 "analytics" I does not think does justice to the reasons why CircleCI may have chosen to use some of them.
The important point is that there are now 8 attack surfaces instead of 1. Whether they're analytics or pad-string doesn't really matter.