Which is probably a net positive on their lives. The less social media the better.

If it’s a package I’m not familiar with and is relatively small/unknown then I’ll give it a brief once over to see if there’s anything that sticks out (obfuscated code, making http requests when the package should never do that, etc.). Most of the time though it is just trusting the FOSS community.

That dog better get praise each time they find it.

Companies do share data either directly or indirectly, so I don’t think your approach of spreading it out is as effective as you think it is. Still not the worst thing to do in addition to other measures though. Another thing is to use a unique email address for each site to make that one common data point no longer common.

Don’t worry bones they’re just security concious and use randomly generated text for security questions.

Where’s my man leek?

YouTube will use data about your user of YouTube to try and personalize your recommendations/searches. Considering this is all within the website I don’t see how this is really that much of an issue. Granted this is Google so we know that data is being used elsewhere.