13 ms·

Update on free software and telemetry

256 points by sm4rk0 7y ago

We have launched important updates to our Terms of Service surrounding our use of telemetry services. Starting with GitLab 12.4, existing customers who use our proprietary products (that is, GitLab.com and the Enterprise Edition of our self-managed offerings) may notice additional Javascript snippets that will interact with GitLab and/or third-party SaaS telemetry service (such as Pendo). For GitLab.com users: as we roll out this update you will be prompted to accept our new Terms of Service. Until the new Terms are accepted access to the web interface and API will be blocked. So, for users who have integrations with our API this will cause a brief pause in service via our API until the terms have been accepted by signing in to the web interface. For Self-managed users: GitLab Core will continue to be free software with no changes. If you want to install your own instance of GitLab without the proprietary software being introduced as a result of this change, GitLab Community Edition (CE) remains a great option. It is licensed under the MIT license (https://en.wikipedia.org/wiki/MIT_License) and will contain no proprietary software. Many open source software projects use GitLab CE for their SCM and CI needs. Again, there will be no changes to GitLab CE. Key Updates: - GitLab.com (GitLab’s SaaS offering)and GitLab's proprietary Self-Managed packages (Starter, Premium, and Ultimate) will now include additional Javascript snippets (both open source and proprietary) that will interact with both GitLab and possibly third-party SaaS telemetry services (we will be using Pendo(https://www.pendo.io)). - We will disclose all such usage in our privacy policy, as well as what we are using the data for. We will also ensure that any third-party telemetry service we use will have data protection standards at least as strong as GitLab and we will aim for SOC2 compliance. Pendo is SOC2 compliant. If you have any questions please contact us at support@gitlab.com

aaomidi 7y ago
Can't wait for them to be fined out of existence for GDPR violations. I've always disliked GitLab as a company - they seem to be too full of themselves.
sm4rk0 7y ago
Had to leave out the "Dear XY" and "Thank you, GitLab Team" in order to fit into 2k char limit.
- dang 7y ago
  We've put in the URL above that has the same text.
4d66ba06 7y ago
Hope there will be way to turn off telemetry when self-hosting GitLab EE but looks like they are saying use CE which doesn't have some key features.
- rambojazz 7y ago
  That's open core for you.
  - jeltz 7y ago
    Yeah, this is yet another example for why you should not rely on open core. I use Gitlab because I liked their product but seems like I was burned again by using an open core product.
- shakna 7y ago
  > In order to service the needs of GitLab.com and GitLab Self-Managed users who do not want to be tracked, both GitLab.com and GitLab Self-Managed will honor the Do Not Track (DNT) mechanism in web browsers. This means that, if you turn on Do Not Track in your browser, GitLab will not load the JavaScript snippet. EE will respect a DNT header. Not amazing, but certainly not impossible to manage. (But on a per-browser basis is still a hack. It should be manageable by the instance itself. Maybe it will be once they have this ready everywhere.) I also believe this isn't rolled out for self-hosted at all yet: > 5d Scott Williamson We are not adding Pendo or Snowplow JS snippets to self hosted versions yet. That will likely come in a second phase of the project, and we will figure out opt in/opt out for those scenarios before launching. The reason we are communicating to those customers about it now is so we don't have to do the privacy policy change twice. So for now it's just .com customers. I will let @Tim Hey respond on where he would like discussion on this to go. [0] [0] https://news.ycombinator.com/item?id=21339805 https://news.ycombinator.com/item?id=21339805
- emilycook 7y ago
  Hello! We're sorry for the confusion, self-hosted EE users are not affected by this change. We opened an issue here to clarify: https://gitlab.com/gitlab-org/growth/product/issues/164 https://gitlab.com/gitlab-org/growth/product/issues/164
dredmorbius 7y ago
Isn't a non-optional, opt-in-by-default third-party telemetry prohibited under GDPR?
- reustle 7y ago
  > Until the new Terms are accepted access to the web interface and API will be blocked. So, for users who have integrations with our API this will cause a brief pause in service via our API until the terms have been accepted by signing in to the web interface. Doesn't this make it not "opt-in-by-default"?
  - jwildeboer 7y ago
    It offers no opt-out and blocks API and web access until you’ve accepted the new terms, so it effectively is opt-in by default.
    - rolph 7y ago
      this sounds like extortion.
  - deleted 7y ago
    [deleted]
  - deleted 7y ago
    [deleted]
  - lolinder 7y ago
    Not according to the EU: > “Freely given” consent essentially means you have not cornered the data subject into agreeing to you using their data. For one thing, that means you cannot require consent to data processing as a condition of using the service. They need to be able to say no. According to Recital 42, “Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.” https://gdpr.eu/gdpr-consent-requirements/ https://gdpr.eu/gdpr-consent-requirements/
- kevin_b_er 7y ago
mfer 7y ago
I hope the inclusion of these new features don't break Gitlab in air gaped environments (or those cases where the DNS is black holed so it doesn't work... though that may be a violation of the terms).
- panpanna 7y ago
  Given many major websites break if you enable tracker-blocking I would guess it will. frontend devs urgently need to learn to write more robust code.
- lbotos 7y ago
  I work at GitLab in Support Engineering I'm talking with product now about this. We raised this when the conversation started as a concern, and I want you to know that internally I am advocating that it _doesn't_.
  - marcinzm 7y ago
    Wait, it's even a question? There are people internally asking for having air-gapped be impossible? I mean, is Gitlab just that tone deaf regarding enterprise or do you just have no enterprise customers to care about?
Aeolun 7y ago
Wow! That’s some change to just drop on us. Guess that settles the issue of whether or not we’re ever going to be able to use this in the enterprise with a big fat no. I’m not really sure why they’re thinking this is a good idea. If I tell the legal team that our source control software is sending off data to the vendor and some random (unspecified?) third parties, they’ll have a fit.
- btasovac 7y ago
  Hello, GitLabber here! We’re currently writing an issue explaining the situation, once it’s public I will link it here.
  - Shank 7y ago
    I think we as developers understand the rationale behind it. The outrage you may see is that in self hosted instances, the companies and people that pick that as their option do so because they want an isolated/independent system. Telemetry from a self hosted system is atypical, especially compared to SaaS that's hosted by you. It's more normal in apps people download that already use the internet, but you already have that option in what you host. Frankly, I used to work at a DoD contractor and we ran GitHub Enterprise and GitLab behind secured networks. That kind of expectation -- that the software will never phone home -- was what let us run and justify them in the first place. Edit: Looks like the comment I replied to has been changed, and essentially removed. I'm sorry if this is now out of context.
  - quickben 7y ago
    "Until the new Terms are accepted access to the web interface and API will be blocked. So, for users who have integrations with our API this will cause a brief pause..." It's not even take it or leave it, one has to agree first in order to leave. It seems whoever approved this, forgot why people arrived to GitLab from GitHub.
  - caiobegotti 7y ago
    It's not that we do not understand that, we do, it's that we don't agree with such stupid and aggressive move considering enterprise setups (I certainly will not use this version if I can avoid it). Shame, this is exactly the opposite of why I migrated to Gitlab.
m463 7y ago
and so it begins. (I was going to post a wall of text about maybe "compassion fatigue with users privacy at odds with debugging" or "the rise of the marketing department" or "monetization strategies"... but the four words above are more succinct)
- CamperBob2 7y ago
  No, it began when we all decided to tolerate involuntary telemetry in Windows. This is just a minor roadside attraction on the same highway.
  - Aeolun 7y ago
    How would be stop that? We can’t switch our whole enterprise over to OSX. We’re very effectively locked in still.
    - m463 7y ago
      osx has lots of telemetry.
  - shakna 7y ago
    Unfortunately, migrating off Windows isn't actually always possible. It can be sometimes, with a kludge. Or by understanding the internals of the toolchains you use. But not all toolchains _can_ be run under another operating system. Or can only be run by violating the rather expensive support contract.
  - asveikau 7y ago
    What I read from this is that Microsoft tainted the word "telemetry". If they had called it something else they wouldn't get people mentally associating it with Windows 10.
    - TeMPOraL 7y ago
      Yeah. They would instead associated it with rockets and spacecraft and other similarly cool stuff.
kevin_b_er 7y ago
https://about.gitlab.com/blog/2019/10/10/update-free-software-and-telemetry/ https://about.gitlab.com/blog/2019/10/10/update-free-softwar... This would be a better link.
- dang 7y ago
  Ok, changed to that from https://gitlab.com/gitlab-org/gitaly/issues/2113 https://gitlab.com/gitlab-org/gitaly/issues/2113. Thanks!
panpanna 7y ago
But why? What can they possibly gain by this?
- deleted 7y ago
  [deleted]
- emilycook 7y ago
  Hello! We opened an issue here including a section on why we made this change: https://gitlab.com/gitlab-org/growth/product/issues/164 https://gitlab.com/gitlab-org/growth/product/issues/164
  - panpanna 7y ago
    That post doesn't really answer anything. There are far less privacy-invasive methods to "analyze usage". Gitlab may have some watertight contract with pendo but that doesn't mean anything to me as a user since I cannot see what is transmitted and how often that is done. Compare to how canonical does this: tell user we are about to send data and show them what is being sent.
    - pndy 7y ago
      Eh, look at comments coming from that account. If that's how they treat their users I think there's little to no chance this stuff will be reverted
dessant 7y ago
> For GitLab.com users: as we roll out this update you will be prompted to accept our new Terms of Service. Until the new Terms are accepted access to the web interface and API will be blocked. Blocking service until the user consents is illegal under GDPR, especially when the consent is requested for data collection that is not essential for providing the service, such as telemetry and analytics. https://gdpr.eu/gdpr-consent-requirements/ https://gdpr.eu/gdpr-consent-requirements/ > “Freely given” consent essentially means you have not cornered the data subject into agreeing to you using their data. For one thing, that means you cannot require consent to data processing as a condition of using the service. They need to be able to say no. According to Recital 42, “Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.”
- buboard 7y ago
  Is this personal data?
  - dessant 7y ago
    Unless they anonymize absolutely everything, including our IP addresses, then yes, it is personal data. https://about.gitlab.com/privacy/ https://about.gitlab.com/privacy/ > Third party tracking services gather certain simple, non-personally identifying information over time, such as your IP address, browser type, internet service provider, referring and exit pages, timestamp, and similar data about your use of the Website. We do not link this information to any of your personal information such as your user name. They don't have to link your IP address to your name, because the IP address itself is already an identifier and so considered personal data.
    - aaomidi 7y ago
      Even then it just takes a very small amount of effort to argue that the anonymized data is still personal and can be linked back to individuals with a bit of statistical analysis.
  - woolly 7y ago
kevin_b_er 7y ago
This is beyond stupid for GitLab. The _PAID_ self-hosted instances will have non-optional telemetry that loads remote javascript inside an enterprise? Any enterprise that seriously wants to self-host will look at this statement and flip a table.
- tgsovlerkhgsel 7y ago
  No, they won't flip a table. They'll talk to the sales guy, tell him "nope", and will receive instructions how to turn it off.
  - Aeolun 7y ago
    That is if anyone on the business end wants Gitlab, but that is almost never the case. The business has to be sold on Gitlab by the developers.
    - deleted 7y ago
      [deleted]
- emilycook 7y ago
  Hello! GitLab employee, I understand the frustration however self-hosted customers on EE will not be affected. We opened an issue here to help clarify: https://gitlab.com/gitlab-org/growth/product/issues/164 https://gitlab.com/gitlab-org/growth/product/issues/164
  - Operyl 7y ago
    Wow the blog host reads poorly then, when I read “self-managed” I assumed managed by the customer, not Hosted Gitlab. You might want to clarify that in the post..
    - deleted 7y ago
      [deleted]
    - 7y ago
rolph 7y ago
how do we pollute or poison the telemetry data?
- marcosdumay 7y ago
  That's a reasonable question for any required or opt-out telemetry collection.
Sir_Cmpwn 7y ago
They've gotta support the $2.74B valuation somehow. This is the ultimate fate of all VC-driven end-user businesses, the incentive model puts users well after investors. This problem is why I bootstrapped my business. https://sourcehut.org/blog/2019-10-23-srht-puts-users-first/ https://sourcehut.org/blog/2019-10-23-srht-puts-users-first/
- pmayrgundter 7y ago
  Very apropos comment and thanks for your service alternative!
- sourcehate 7y ago
  And yet, you're already taking Sourcehut's money and using it to pay a developer that you've said won't be doing any direct work for Sourcehut [1]. How in the world can you possibly call it "putting users first" to take users' money and use it to pay someone to do things that don't benefit those users? Seems a lot more like you're using the company money to pay for things you want someone to work on, not your users. How can that be the company's top priority and the first hire? (throwaway account because Drew holds grudges for years when people question him) [1]: https://sourcehut.org/blog/2019-10-15-whats-cooking-october-2019/ https://sourcehut.org/blog/2019-10-15-whats-cooking-october-...
  - Sir_Cmpwn 7y ago
    Seems this has been vouched out of its shadowban, so I can reply now. I'm extremely proud to be sponsoring Simon's open source work, and I'm looking forward to sponsoring others. I don't intend to turn SourceHut into an Uber-esque business where a veritable army of developers is sitting around and doing nothing. Most SourceHut users who have been keeping abreast of my plans have known that I wanted to re-invest the profits in open source, and this is how I've chosen to do it. This does benefit SourceHut users, by enriching the open source community in a way no other company is doing. >(throwaway account because Drew holds grudges for years when people question him) I don't know where this came from, but it's not really appropriate. It seems more likely that you have a grude with me.
jchw 7y ago
I am (was?) a big supporter of GitLab and am having trouble believing what I’m reading. GitLab.com having analytics, whatever. But Gitlab EE having mandatory analytics? This just seems downright out of touch.
- emilycook 7y ago
  Hello! We're sorry for the confusion however EE is unaffected by this. We wrote an issue here to clarify: https://gitlab.com/gitlab-org/growth/product/issues/164 https://gitlab.com/gitlab-org/growth/product/issues/164
  - NullPrefix 7y ago
    s/unaffected/unaffected yet/
  - paintstripper 7y ago
    EE being unaffected (for now) is not the point, the problem is the way this was announced, especially opt-out by default. I can't ever recommend GitLab in companies I work for now, because my trust in GitLab has been shaken.
  - jahlove 7y ago
    > Enterprise Edition (EE) > > No current changes. We are not adding telemetry services to EE at this time. Do I have to agree to the TOS at this time?
spaniard_dev 7y ago
Just use the DNT header and they won't track you.
- lolinder 7y ago
  This doesn't help the concern from enterprise users that they don't want their self-hosted software to phone home, ever.
  - emilycook 7y ago
    Hello! Self-hosted users on EE are currently not affected, we opened an issue here to clarify: https://gitlab.com/gitlab-org/growth/product/issues/164 https://gitlab.com/gitlab-org/growth/product/issues/164
    - lolinder 7y ago
      "Not yet" is small comfort.
- Deimorz 7y ago
  DNT was a failure that shouldn't be depended on for anything. Safari has already removed it in version 12.1 (https://developer.apple.com/documentation/safari_release_notes/safari_12_1_release_notes https://developer.apple.com/documentation/safari_release_not...), so if that's the only opt-out mechanism there's no way for Safari users to make that choice. That probably includes all iOS users, since all iOS browsers just wrap Safari. I wouldn't be surprised to see other browsers remove it eventually as well. Like Apple says, it ended up doing the exact opposite of what it was supposed to -- almost nobody obeys it anyway, and it hurts the privacy of people that try to use it by contributing an uncommon factor to their browser fingerprint.
- rambojazz 7y ago
  DNT suffers from a lack of trust. I have turned it on by default, but I kind of assume that it's completely ignored.
pmontra 7y ago
So, time to go back to GitHub? https://www.vice.com/en_us/article/ywen8x/13000-projects-ditched-github-for-gitlab-monday-morning https://www.vice.com/en_us/article/ywen8x/13000-projects-dit... I'm self hosting my projects on one of my servers but I have some projects on GitHub because I want them to be public. I copied them on GitLab one year ago and switched origin. I feel like I won't keep using that service now. Bitbucket is quite a pain to use so it's not an alternative.
- aaomidi 7y ago
  There was no reason to leave GitHub. People started boycotting GitHub before GitHub even did anything wrong.
  - ekianjo 7y ago
    Github has tons of tracking.
  - vunie 7y ago
    GitHub is unreliable: GitHub bases the decision of blocking projects on the subjectivity of moderators. Bellow are two cases I could recall (I'm sure there are more): 1. https://news.ycombinator.com/item?id=19182956 https://news.ycombinator.com/item?id=19182956 2. https://tech.slashdot.org/story/13/12/14/1618239/github-takes-down-satirical-c-plus-equality-language https://tech.slashdot.org/story/13/12/14/1618239/github-take... To me, not knowing when or why my software might be dropped is a fatal flaw for a service that exists to serve source code.
  - kgwxd 7y ago
    People started boycotting GitHub when it became Microsoft, with decades of evidence to back it up.
  - authoritarian 7y ago
    There have been, and continue to be, a variety of reasons to leave Github edit: Ah I see you work for Microsoft. In that case it's not surprising you are stating that there are no reasons to leave
lbotos 7y ago
I work at GitLab. Support Engineering Managers were briefed about this a few days ago. From inside GitLab Slack: 5d Scott Williamson We are not adding Pendo or Snowplow JS snippets to self hosted versions yet. That will likely come in a second phase of the project, and we will figure out opt in/opt out for those scenarios before launching. The reason we are communicating to those customers about it now is so we don't have to do the privacy policy change twice. So for now it's just .com customers. I will let @Tim Hey respond on where he would like discussion on this to go. 5d Support Engineer Thank you @Scott Williamson, I was hesitant to ping you as I know your time is valuable, but I'm glad that I did. :thank_you::thx::thankyou: 5d Tim Hey Hi @Support Engineer Looks like @Scott Williamson just beat me to the it. :sweat_smile: 5d Support Engineer You both are amazing and I can't thank you enough. 5d Tim Hey Also if you are interested in the being part of the discussion when we build out the opt in for scenarios like this I'd love to include you. I believe Lee was interested. 5d Support Engineer I'd love to be involved! If there's an opt-in or opt-out, it invalidates all the concerns I voiced here. Knowing this, I fully support the decision to add telemetry to self-managed and understand that it would be incredibly valuable for growth. 41m Support Engineer @Scott Williamson @Tim Hey @supportmanagers We have a lot of upset customers thinking that GitLab self-managed telemetry will be mandatory for Self-Managed GitLab moving forward (no opt-out/opt-in) . We need an official response and Zendesk template to help manage the influx
- OnlineGladiator 7y ago
  I am not sure it is a good idea to post internal slack conversations to a thread like this on HN.
  - lbotos 7y ago
    I asked Scott, VP of Product, if he was okay with it. He was. In earnest, it should have been on an issue, so I could have linked to it directly.
- deleted 7y ago
  [deleted]
- marcinzm 7y ago
Peckingjay 7y ago
edit: Comment no longer relevant since URL has been updated.
- deleted 7y ago
  [deleted]
- dang 7y ago
  We updated the URL above to that one. Before that it was https://gitlab.com/gitlab-org/gitaly/issues/2113 https://gitlab.com/gitlab-org/gitaly/issues/2113.
  - YorickPeterse 7y ago
    Which has been moved to https://gitlab.com/gitlab-org/gitlab/issues/34833 https://gitlab.com/gitlab-org/gitlab/issues/34833, since it was using the wrong issue tracker before.
- ahbyb 7y ago
  That doesn't mean you have to edit what it said...
  - Peckingjay 7y ago
    It was a copy paste of a section of the blog post now linked, nothing more.
jknoepfler 7y ago
How does this help gitlab's customers? (sincere question, my initial reaction has already been voiced here by others)
- geofft 7y ago
  Helps them see how people are actually using the product, what's difficult, what's popular, etc. And, of course, helps them make more money so they can hire more people/stay alive/etc.
  - caiobegotti 7y ago
    How this being mandatory without opt-in help Gitlab users, more specifically?
- emilycook 7y ago
  Hello! Thanks for your feedback, because of it we added a section on our new issue about why we're doing this: https://gitlab.com/gitlab-org/growth/product/issues/164 https://gitlab.com/gitlab-org/growth/product/issues/164
- jjgreen 7y ago
  Heh, I read that as "How does this help gitlab's competitors?" and thought "isn't that obvious?"
victor9000 7y ago
Don't go down this road. The moment you place corporate needs ahead of user needs is the moment you start losing user advocates (UAs). New features are shiny objects that may attract interest, but UAs are your long-term lifeblood. They don't just use your product, they recommend it to friends, teams, bosses, and organizations. I'm not going to be as pessimistic as others in this thread bc I know you guys have what it takes to do the right thing. But know that a tide change has occurred when it comes to privacy and data, and technical folks are keenly aware of the importance of protecting both.
- sytse 7y ago
  I agree that user advocates are our lifeblood and we're risking alienating them. There were many more concerns than we expected. We’re going to process the feedback and rethink our plan. We will not activate product usage tracking on GitLab.com or GitLab self-managed before we address the feedback and re-evaluate our plan. We will make sure to communicate our proposed changes prior to any changes to GitLab.com or self-managed instances, and give sufficient time for people to provide feedback for a new proposal. We'll work in https://gitlab.com/gitlab-com/www-gitlab-com/issues/5672 https://gitlab.com/gitlab-com/www-gitlab-com/issues/5672
  - apple4ever 7y ago
    > There were many more concerns than we expected. I really don't understand how this can be true. Just reading it briefly I knew there were going to be a ton of concerns.
    - patrickmn 7y ago
      Honestly, it's shocking that this came as a surprise. It's like they don't know why they made Gitlab self-hostable.
  - jacquesm 7y ago
    > We will not activate product usage tracking on GitLab.com or GitLab self-managed before we address the feedback and re-evaluate our plan. I would like to see a harder commitment: to simply not do this. Gitlab does not have any credible reasons to add product usage tracking that does not have substantial downsides, better to steer clear of this completely.
jfkw 7y ago
From the article "... To make GitLab better faster, we need more data on how users are using GitLab. SaaS telemetry products, which provide analytics on user behavior inside web-based applications, have come a long way in the past few years. They are an important tool for rapidly improving user experiences because you can understand what users are doing (or not doing) in the app. GitLab has a lot of features, and a lot of users, and it is time that we use telemetry to get the data we need for our product managers to improve the experience." This doesn't seem like a sufficiently good justification add telemetry features which some users may find objectionable. Perhaps those resources would be better spent on a feature that let the user who is annoyed by a slow operation to: - Begin recording user interaction telemetry locally - Perform the slow or buggy operation - Stop recording, generating a data bundle file. - Allow the user to review the data bundle in human-readable format - Optionally take the data bundle to a less secured system as needed - Submit the data bundle to GitLab engineering as a well-filed issue Done that way, I think most users would welcome the interaction with Gitlab. For telemetry, not so much.
- jkdufair 7y ago
  That sounds like recipe for near-zero participation. I think both the intent and execution are spot-on here for GitLab. They are offering a very straightforward option for using GitLab, telemetry-free.
- kazlock 7y ago
  I'm not arguing for or against tracking, but I disagree with some of these assumptions: 1) 99% of users who have a bad experience are not going to be bothered to figure out how to record, review, and submit their session for the benefit of the service provider. If a page has issues loading, they're just going to give up and move on to the next thing. 2) User tracking isn't really related to performance in the first place. If some server side operation is failing or taking a long time to load, engineers will find out (and probably get paged) with user-agnostic internal performance metrics. 3) User tracking isn't just about finding out what's broken with the site, its about understanding how the site is being used in general so that you can validate your assumptions and make product decisions backed by data.
tgsovlerkhgsel 7y ago
> if you turn on Do Not Track in your browser, GitLab will not load the JavaScript snippet This is actually awesome, and a very rare thing as far as I can tell.
leeoniya 7y ago
they just keep rolling out the hits https://news.ycombinator.com/item?id=21274511 https://news.ycombinator.com/item?id=21274511
oedmarap 7y ago
> In order to service the needs of GitLab.com and GitLab Self-Managed users who do not want to be tracked, both GitLab.com and GitLab Self-Managed will honor the Do Not Track (DNT) mechanism in web browsers. This means that, if you turn on Do Not Track in your browser, GitLab will not load the JavaScript snippet. Ok so GitLab dotcom promises to honor DNT, which is good. > GitLab Community Edition will continue to be free software with no changes. So GitLab CE is not "affected" at all, which is better. I've never used the Enterprise Editions, but what's to stop enterprise ops/sysadmins from just blocking the third-party requests at the DNS level (regardless of the DNT promise)? Another HNer mentioned this re: air-gapped deployments. So in a purely practical sense, is the only noteworthy takeaway simply an extra production config step involving DNS?
kd3 7y ago
Going to be interesting to hear from the people who left Github for Gitlab when Microsoft took over.
throwawayofc2 7y ago
https://gitlab.com/gitlab-org/gitlab/issues/34833#note_234752308 https://gitlab.com/gitlab-org/gitlab/issues/34833#note_23475... For paying Gitlab customers, this sums up the general opinion well.
simpss 7y ago
this is a clear violation of GDPR, unless they can really guarantee the data is 100% anonymous, gitlab was able to provide the service without telemetry & is now blocking access to the (self-hosted) service unless one consents to the new data gathering practices. Best of all, 12.4 was released 2 days ago, the notification e-mail was sent out today...
emilycook 7y ago
Hi! GitLab employee here. We understand this is a topic that you all are concerned about, so we opened an issue to help clarify [1]. If you have any comments or concerns you’d like to relay back to us, you can do so there! We appreciate the feedback and want to be as transparent and accommodating as possible. [1] https://gitlab.com/gitlab-org/growth/product/issues/164 https://gitlab.com/gitlab-org/growth/product/issues/164
- manbash 7y ago
  Why is the following still open then? https://gitlab.com/gitlab-org/gitlab/issues/34833 https://gitlab.com/gitlab-org/gitlab/issues/34833 Are those not conflicting each other? Genuinely curious.
- request136340 7y ago
  > GitLab employee here. [..] If you have any comments or concerns you’d like to relay back to us, you can do so there! In order to leave the feedback "there", one has to accept new Terms of Service. Folks who refused new TOS can not log in... Just in case if not all GitLab employees realize how bad the situation is. But here's the feedback using HN, the user-friendly platform: Please add an option to "delete and erase account" button when user decides to decline the new TOS. https://news.ycombinator.com/item?id=21342650 https://news.ycombinator.com/item?id=21342650
gorkemcetin 7y ago
Out of curiosity Gitlabbers, have you thought about using an onpremises, self hosted product analytics/telemetry solution like Countly so that you don’t have to share PII data with a 3rd party? (disclaimer as usual: I work there).
couchand 7y ago
There was apparently months of internal discussion on this topic [0][1][2][3] (edit: particularly here [1.5] "It's not practical to send all of this metadata with every event, especially since we don't know what metadata we'll need ahead of time. In order to do anything beyond surface-level analysis, we need to be able to join on user_id."). In the end, the folks at the very top overruled the (relative) consensus that had been reached by Engineering, Product [4], and Compliance [5] that the tracking should only be done on an opt-in basis. Paul Machle, CFO, responding in no uncertain terms that the consensus was not acceptable: "I don’t understand. This should not be an opt in or an opt out. It is a condition of using our product. There is an acceptance of terms and the use of this data should be included in that." [6] The real juicy discussion seems to be on a private repo [7]. The final implementation plan [8] shows that tracking will be non-optional, including for self-hosted EE instances. [0]: https://gitlab.com/gitlab-org/gitlab-foss/issues/64341 https://gitlab.com/gitlab-org/gitlab-foss/issues/64341 [1]: https://gitlab.com/gitlab-org/telemetry/issues/57 https://gitlab.com/gitlab-org/telemetry/issues/57 [1.5]: https://gitlab.com/gitlab-org/telemetry/issues/57#note_190415032 https://gitlab.com/gitlab-org/telemetry/issues/57#note_19041... [2]: https://gitlab.com/gitlab-org/gitlab/merge_requests/14182 https://gitlab.com/gitlab-org/gitlab/merge_requests/14182 [3]: https://gitlab.com/gitlab-org/telemetry/issues/58 https://gitlab.com/gitlab-org/telemetry/issues/58 [4]: https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#note_203848357 https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#no... [5]: https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#note_185762038 https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#no... [6]: https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#note_203849107 https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#no... [7]: https://gitlab.com/gitlab-com/gl-security/compliance/compliance/issues/656 https://gitlab.com/gitlab-com/gl-security/compliance/complia... [8]: https://gitlab.com/groups/gitlab-org/-/epics/1937 https://gitlab.com/groups/gitlab-org/-/epics/1937
- ktsmith 7y ago
  > Paul Machle, CTO Paul is the CFO.
  - couchand 7y ago
    facepalm thanks for the correction. Edited.
hajimuz 7y ago
Nobody really reads , not even smart hackers. That is my first thought after reading a lot of comments.
ivanjaros 7y ago
its funny how "spying" became "telemetry". you see it everywhere..and it seems to we working.
- dijit 7y ago
  Always beware those who try to control language. A recent (thankfully failed) example is Nigel Farage talking about a "No Deal" brexit as a "Clean Break" brexit. (sorry to bring up brexit, but it was a very recent example that sticks out in my mind)
raxxorrax 7y ago
I see that as a severely negative development and that opens a lot of room for competitors. I don't think you made the correct decision here, Gitlab.
kaffeemitsahne 7y ago
Data is the new crack. They just can't resist it.
trbfred 7y ago
... I felt quite confirmed while reading this. After months of thoughts and plans, I finally invested some hours to install Gitea on my Synology NAS and migrating all GitLab projects there. Combined with Synology Drive + Wireguard running on an EdgeRouter by Ubiquiti, this feels somehow good. Of course, just for my personal files that don't require collaboration with others ...
maxehmookau 7y ago
This is a bad move. Why not do what every other software package does and when you install it, ask if you want to "send anonymised information to help us improve the product". I now have to convince managers that GL is still safe to use and there's no data exfiltration risk!
account42 7y ago
So to make GitLab faster you are going to add more JS bloat. Ok.
the-dude 7y ago
I wonder if the remote-ness of the company has contributed to the out-of-touch-ness of this idea.
romanovcode 7y ago
Seems they are preparing for selling to Google!
sfwilliamson 7y ago
GitLab employee here. First of all, my apologies for the confusing messaging to our customer base. This change is only for our .com customers. We have not yet added instrumentation to the self-hosted Enterprise edition versions, and we will not do so until we have a way for self-hosted customers to easily control whether tracking is enabled in their environment. As an example, we currently have a feature called "usage ping" which sends back aggregate usage data, and self-hosted customers have the option to turn it off. We will continue to allow self-hosted customers to control the level of product usage data that is tracked in their environment, or turn it off completely. We also will not add tracking to the Community Edition, so that is always an option for customers. I want to reiterate that we are using this data to improve the product experience. Currently we are blind to what is being used in the product, how customers flow through the system, etc. Without this usage data it is very difficult to build a great customer experience.
- aaxa 7y ago
  And I guess you will make it opt-in instead of opt-out for the self-hosted Enterprise Edition, right? Edit: also, the email you sent out to your users is very different from your blog post. In the blog post you ask for feedback from your users, which is not the case in the email, which is written as an actual announcement that this is going to happen.
  - sfwilliamson 7y ago
    We've heard your concerns and questions. There were many more concerns than we expected. We’re going to process the feedback and rethink our plan. We will not activate product usage tracking on GitLab.com or GitLab self-managed before we address the feedback and re-evaluate our plan. We will make sure to communicate our proposed changes prior to any changes to GitLab.com or self-managed instances, and give sufficient time for people to provide feedback for a new proposal. We'll work in this issue: https://gitlab.com/gitlab-com/www-gitlab-com/issues/5672 https://gitlab.com/gitlab-com/www-gitlab-com/issues/5672 Here's an MR updating our blog post accordingly: https://gitlab.com/gitlab-com/www-gitlab-com/merge_requests/33289/diffs#note_235139590 https://gitlab.com/gitlab-com/www-gitlab-com/merge_requests/...
dvtrn 7y ago
I've counted four different people who announced they work at Gitlab, in various different departments of the company. Appreciate you all showing up, on the one hand, when so many different roles are all showing up in a thread to offer justifications and explanations it looks very uncoordinated, this isn't a good look.
darkmarmot 7y ago
Well, looks like I no longer need to suggest we switch to Gitlab for our Fortune 100 :(
jrcii 7y ago
Ok so GitLab (who I’ve been rooting for for years) is evil now. Add to blacklist of organizations that prioritize money over respect for users. Got it.
munmaek 7y ago
Guess I’ll continue to self host Gitea and use SourceHut instead. Those are faster anyway.
- dkersten 7y ago
  Thanks for the suggestions! I'm going to start moving over.
rq1 7y ago
Hello! GitLab employee here... No just kidding.
authoritarian 7y ago
Looks like it's time to find a new service. This is very disappointing
simpss 7y ago
from gitlab: https://gitlab.com/gitlab-org/gitlab/issues/34833#note_235154077 https://gitlab.com/gitlab-org/gitlab/issues/34833#note_23515... ------------------ We've heard your concerns and questions. There were many more concerns than we expected. We’re going to process the feedback and rethink our plan. We will not activate product usage tracking on GitLab.com or GitLab self-managed before we address the feedback and re-evaluate our plan. We will make sure to communicate our proposed changes prior to any changes to GitLab.com or self-managed instances, and give sufficient time for people to provide feedback for a new proposal. We'll work in this issue.[1] Here's an MR updating our blog post accordingly: gitlab-com/www-gitlab-com!33289 (diffs, comment 235139590)[2] ------------------------- 1 - https://gitlab.com/gitlab-com/www-gitlab-com/issues/5672 https://gitlab.com/gitlab-com/www-gitlab-com/issues/5672 2 - https://gitlab.com/gitlab-com/www-gitlab-com/merge_requests/33289/diffs#note_235139590 https://gitlab.com/gitlab-com/www-gitlab-com/merge_requests/...
- jagged-chisel 7y ago
  Did we get a reversion to the older ToS with this?
  - simpss 7y ago
    no concrete answer regarding that yet. I don't think the new ToS was published on gitlab.com already, so this might not be necessary. I asked the question to get a clear answer, probably won't hear anything back regarding this. edit: ToS has been rolled back as well: https://gitlab.com/gitlab-org/gitlab/issues/34833#note_235221218 https://gitlab.com/gitlab-org/gitlab/issues/34833#note_23522...
0xffff2 7y ago
I just deleted my Gitlab account. I'll be self-hosting personal projects from now on. It's clear that as an individual user of a third-party service you have virtually no control. No matter who you choose, the odds are that the owners of the service will eventually succumb to the siren song of VC money and sell their users' souls as a result.
deleted 7y ago
[deleted]
thsowers 7y ago
Additional discussion that is currently marked as a [dupe]: https://news.ycombinator.com/item?id=21343761 https://news.ycombinator.com/item?id=21343761
jammygit 7y ago
Seems like a good time to ask: who is using source hut? How do they find the email driven merge request process?
julienfr112 7y ago
Why send user data to third party ? Don't they have the man power to build a db with all the logs and maybe add that to a securing ml bullshit for Enterprise ?
jacquesm 7y ago
Don't ever do this. I'm a huge gitlab advocate and I'm already wondering if I should regret that. Keep in mind that one thing that keeps gitlab alive is that which it is not: github/microsoft. If you erase that boundary then there is no longer any good reason to recommend gitlab over github.

256 points by sm4rk0 7y ago

aaomidi 7y ago

Can't wait for them to be fined out of existence for GDPR violations. I've always disliked GitLab as a company - they seem to be too full of themselves.

sm4rk0 7y ago

Had to leave out the "Dear XY" and "Thank you, GitLab Team" in order to fit into 2k char limit.

dang 7y ago
We've put in the URL above that has the same text.

4d66ba06 7y ago

Hope there will be way to turn off telemetry when self-hosting GitLab EE but looks like they are saying use CE which doesn't have some key features.

rambojazz 7y ago
That's open core for you.
- jeltz 7y ago
  Yeah, this is yet another example for why you should not rely on open core. I use Gitlab because I liked their product but seems like I was burned again by using an open core product.
shakna 7y ago
> In order to service the needs of GitLab.com and GitLab Self-Managed users who do not want to be tracked, both GitLab.com and GitLab Self-Managed will honor the Do Not Track (DNT) mechanism in web browsers. This means that, if you turn on Do Not Track in your browser, GitLab will not load the JavaScript snippet. EE will respect a DNT header. Not amazing, but certainly not impossible to manage. (But on a per-browser basis is still a hack. It should be manageable by the instance itself. Maybe it will be once they have this ready everywhere.) I also believe this isn't rolled out for self-hosted at all yet: > 5d Scott Williamson We are not adding Pendo or Snowplow JS snippets to self hosted versions yet. That will likely come in a second phase of the project, and we will figure out opt in/opt out for those scenarios before launching. The reason we are communicating to those customers about it now is so we don't have to do the privacy policy change twice. So for now it's just .com customers. I will let @Tim Hey respond on where he would like discussion on this to go. [0] [0] https://news.ycombinator.com/item?id=21339805 https://news.ycombinator.com/item?id=21339805
emilycook 7y ago
Hello! We're sorry for the confusion, self-hosted EE users are not affected by this change. We opened an issue here to clarify: https://gitlab.com/gitlab-org/growth/product/issues/164 https://gitlab.com/gitlab-org/growth/product/issues/164

dredmorbius 7y ago

Isn't a non-optional, opt-in-by-default third-party telemetry prohibited under GDPR?

reustle 7y ago
> Until the new Terms are accepted access to the web interface and API will be blocked. So, for users who have integrations with our API this will cause a brief pause in service via our API until the terms have been accepted by signing in to the web interface. Doesn't this make it not "opt-in-by-default"?
- jwildeboer 7y ago
  It offers no opt-out and blocks API and web access until you’ve accepted the new terms, so it effectively is opt-in by default.
  - rolph 7y ago
    this sounds like extortion.
- deleted 7y ago
  [deleted]
- deleted 7y ago
  [deleted]
- lolinder 7y ago
  Not according to the EU: > “Freely given” consent essentially means you have not cornered the data subject into agreeing to you using their data. For one thing, that means you cannot require consent to data processing as a condition of using the service. They need to be able to say no. According to Recital 42, “Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.” https://gdpr.eu/gdpr-consent-requirements/ https://gdpr.eu/gdpr-consent-requirements/
kevin_b_er 7y ago

mfer 7y ago

I hope the inclusion of these new features don't break Gitlab in air gaped environments (or those cases where the DNS is black holed so it doesn't work... though that may be a violation of the terms).

panpanna 7y ago
Given many major websites break if you enable tracker-blocking I would guess it will. frontend devs urgently need to learn to write more robust code.
lbotos 7y ago
I work at GitLab in Support Engineering I'm talking with product now about this. We raised this when the conversation started as a concern, and I want you to know that internally I am advocating that it _doesn't_.
- marcinzm 7y ago
  Wait, it's even a question? There are people internally asking for having air-gapped be impossible? I mean, is Gitlab just that tone deaf regarding enterprise or do you just have no enterprise customers to care about?

Aeolun 7y ago

Wow! That’s some change to just drop on us. Guess that settles the issue of whether or not we’re ever going to be able to use this in the enterprise with a big fat no. I’m not really sure why they’re thinking this is a good idea. If I tell the legal team that our source control software is sending off data to the vendor and some random (unspecified?) third parties, they’ll have a fit.

btasovac 7y ago
Hello, GitLabber here! We’re currently writing an issue explaining the situation, once it’s public I will link it here.
- Shank 7y ago
  I think we as developers understand the rationale behind it. The outrage you may see is that in self hosted instances, the companies and people that pick that as their option do so because they want an isolated/independent system. Telemetry from a self hosted system is atypical, especially compared to SaaS that's hosted by you. It's more normal in apps people download that already use the internet, but you already have that option in what you host. Frankly, I used to work at a DoD contractor and we ran GitHub Enterprise and GitLab behind secured networks. That kind of expectation -- that the software will never phone home -- was what let us run and justify them in the first place. Edit: Looks like the comment I replied to has been changed, and essentially removed. I'm sorry if this is now out of context.
- quickben 7y ago
  "Until the new Terms are accepted access to the web interface and API will be blocked. So, for users who have integrations with our API this will cause a brief pause..." It's not even take it or leave it, one has to agree first in order to leave. It seems whoever approved this, forgot why people arrived to GitLab from GitHub.
- caiobegotti 7y ago
  It's not that we do not understand that, we do, it's that we don't agree with such stupid and aggressive move considering enterprise setups (I certainly will not use this version if I can avoid it). Shame, this is exactly the opposite of why I migrated to Gitlab.

m463 7y ago

and so it begins. (I was going to post a wall of text about maybe "compassion fatigue with users privacy at odds with debugging" or "the rise of the marketing department" or "monetization strategies"... but the four words above are more succinct)

CamperBob2 7y ago
No, it began when we all decided to tolerate involuntary telemetry in Windows. This is just a minor roadside attraction on the same highway.
- Aeolun 7y ago
  How would be stop that? We can’t switch our whole enterprise over to OSX. We’re very effectively locked in still.
  - m463 7y ago
    osx has lots of telemetry.
- shakna 7y ago
  Unfortunately, migrating off Windows isn't actually always possible. It can be sometimes, with a kludge. Or by understanding the internals of the toolchains you use. But not all toolchains _can_ be run under another operating system. Or can only be run by violating the rather expensive support contract.
- asveikau 7y ago
  What I read from this is that Microsoft tainted the word "telemetry". If they had called it something else they wouldn't get people mentally associating it with Windows 10.
  - TeMPOraL 7y ago
    Yeah. They would instead associated it with rockets and spacecraft and other similarly cool stuff.

kevin_b_er 7y ago

https://about.gitlab.com/blog/2019/10/10/update-free-software-and-telemetry/ https://about.gitlab.com/blog/2019/10/10/update-free-softwar... This would be a better link.

dang 7y ago
Ok, changed to that from https://gitlab.com/gitlab-org/gitaly/issues/2113 https://gitlab.com/gitlab-org/gitaly/issues/2113. Thanks!

panpanna 7y ago

But why? What can they possibly gain by this?

deleted 7y ago
[deleted]
emilycook 7y ago
Hello! We opened an issue here including a section on why we made this change: https://gitlab.com/gitlab-org/growth/product/issues/164 https://gitlab.com/gitlab-org/growth/product/issues/164
- panpanna 7y ago
  That post doesn't really answer anything. There are far less privacy-invasive methods to "analyze usage". Gitlab may have some watertight contract with pendo but that doesn't mean anything to me as a user since I cannot see what is transmitted and how often that is done. Compare to how canonical does this: tell user we are about to send data and show them what is being sent.
  - pndy 7y ago
    Eh, look at comments coming from that account. If that's how they treat their users I think there's little to no chance this stuff will be reverted

dessant 7y ago

> For GitLab.com users: as we roll out this update you will be prompted to accept our new Terms of Service. Until the new Terms are accepted access to the web interface and API will be blocked. Blocking service until the user consents is illegal under GDPR, especially when the consent is requested for data collection that is not essential for providing the service, such as telemetry and analytics. https://gdpr.eu/gdpr-consent-requirements/ https://gdpr.eu/gdpr-consent-requirements/ > “Freely given” consent essentially means you have not cornered the data subject into agreeing to you using their data. For one thing, that means you cannot require consent to data processing as a condition of using the service. They need to be able to say no. According to Recital 42, “Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.”

buboard 7y ago
Is this personal data?
- dessant 7y ago
  Unless they anonymize absolutely everything, including our IP addresses, then yes, it is personal data. https://about.gitlab.com/privacy/ https://about.gitlab.com/privacy/ > Third party tracking services gather certain simple, non-personally identifying information over time, such as your IP address, browser type, internet service provider, referring and exit pages, timestamp, and similar data about your use of the Website. We do not link this information to any of your personal information such as your user name. They don't have to link your IP address to your name, because the IP address itself is already an identifier and so considered personal data.
  - aaomidi 7y ago
    Even then it just takes a very small amount of effort to argue that the anonymized data is still personal and can be linked back to individuals with a bit of statistical analysis.
- woolly 7y ago

kevin_b_er 7y ago

This is beyond stupid for GitLab. The _PAID_ self-hosted instances will have non-optional telemetry that loads remote javascript inside an enterprise? Any enterprise that seriously wants to self-host will look at this statement and flip a table.

tgsovlerkhgsel 7y ago
No, they won't flip a table. They'll talk to the sales guy, tell him "nope", and will receive instructions how to turn it off.
- Aeolun 7y ago
  That is if anyone on the business end wants Gitlab, but that is almost never the case. The business has to be sold on Gitlab by the developers.
  - deleted 7y ago
    [deleted]
emilycook 7y ago
Hello! GitLab employee, I understand the frustration however self-hosted customers on EE will not be affected. We opened an issue here to help clarify: https://gitlab.com/gitlab-org/growth/product/issues/164 https://gitlab.com/gitlab-org/growth/product/issues/164
- Operyl 7y ago
  Wow the blog host reads poorly then, when I read “self-managed” I assumed managed by the customer, not Hosted Gitlab. You might want to clarify that in the post..
  - deleted 7y ago
    [deleted]
  - 7y ago

rolph 7y ago

how do we pollute or poison the telemetry data?

marcosdumay 7y ago
That's a reasonable question for any required or opt-out telemetry collection.

Sir_Cmpwn 7y ago

They've gotta support the $2.74B valuation somehow. This is the ultimate fate of all VC-driven end-user businesses, the incentive model puts users well after investors. This problem is why I bootstrapped my business. https://sourcehut.org/blog/2019-10-23-srht-puts-users-first/ https://sourcehut.org/blog/2019-10-23-srht-puts-users-first/

pmayrgundter 7y ago
Very apropos comment and thanks for your service alternative!
sourcehate 7y ago
And yet, you're already taking Sourcehut's money and using it to pay a developer that you've said won't be doing any direct work for Sourcehut [1]. How in the world can you possibly call it "putting users first" to take users' money and use it to pay someone to do things that don't benefit those users? Seems a lot more like you're using the company money to pay for things you want someone to work on, not your users. How can that be the company's top priority and the first hire? (throwaway account because Drew holds grudges for years when people question him) [1]: https://sourcehut.org/blog/2019-10-15-whats-cooking-october-2019/ https://sourcehut.org/blog/2019-10-15-whats-cooking-october-...
- Sir_Cmpwn 7y ago
  Seems this has been vouched out of its shadowban, so I can reply now. I'm extremely proud to be sponsoring Simon's open source work, and I'm looking forward to sponsoring others. I don't intend to turn SourceHut into an Uber-esque business where a veritable army of developers is sitting around and doing nothing. Most SourceHut users who have been keeping abreast of my plans have known that I wanted to re-invest the profits in open source, and this is how I've chosen to do it. This does benefit SourceHut users, by enriching the open source community in a way no other company is doing. >(throwaway account because Drew holds grudges for years when people question him) I don't know where this came from, but it's not really appropriate. It seems more likely that you have a grude with me.

jchw 7y ago

I am (was?) a big supporter of GitLab and am having trouble believing what I’m reading. GitLab.com having analytics, whatever. But Gitlab EE having mandatory analytics? This just seems downright out of touch.

emilycook 7y ago
Hello! We're sorry for the confusion however EE is unaffected by this. We wrote an issue here to clarify: https://gitlab.com/gitlab-org/growth/product/issues/164 https://gitlab.com/gitlab-org/growth/product/issues/164
- NullPrefix 7y ago
  s/unaffected/unaffected yet/
- paintstripper 7y ago
  EE being unaffected (for now) is not the point, the problem is the way this was announced, especially opt-out by default. I can't ever recommend GitLab in companies I work for now, because my trust in GitLab has been shaken.
- jahlove 7y ago
  > Enterprise Edition (EE) > > No current changes. We are not adding telemetry services to EE at this time. Do I have to agree to the TOS at this time?

spaniard_dev 7y ago

Just use the DNT header and they won't track you.

lolinder 7y ago
This doesn't help the concern from enterprise users that they don't want their self-hosted software to phone home, ever.
- emilycook 7y ago
  Hello! Self-hosted users on EE are currently not affected, we opened an issue here to clarify: https://gitlab.com/gitlab-org/growth/product/issues/164 https://gitlab.com/gitlab-org/growth/product/issues/164
  - lolinder 7y ago
    "Not yet" is small comfort.
Deimorz 7y ago
DNT was a failure that shouldn't be depended on for anything. Safari has already removed it in version 12.1 (https://developer.apple.com/documentation/safari_release_notes/safari_12_1_release_notes https://developer.apple.com/documentation/safari_release_not...), so if that's the only opt-out mechanism there's no way for Safari users to make that choice. That probably includes all iOS users, since all iOS browsers just wrap Safari. I wouldn't be surprised to see other browsers remove it eventually as well. Like Apple says, it ended up doing the exact opposite of what it was supposed to -- almost nobody obeys it anyway, and it hurts the privacy of people that try to use it by contributing an uncommon factor to their browser fingerprint.
rambojazz 7y ago
DNT suffers from a lack of trust. I have turned it on by default, but I kind of assume that it's completely ignored.

pmontra 7y ago

So, time to go back to GitHub? https://www.vice.com/en_us/article/ywen8x/13000-projects-ditched-github-for-gitlab-monday-morning https://www.vice.com/en_us/article/ywen8x/13000-projects-dit... I'm self hosting my projects on one of my servers but I have some projects on GitHub because I want them to be public. I copied them on GitLab one year ago and switched origin. I feel like I won't keep using that service now. Bitbucket is quite a pain to use so it's not an alternative.

aaomidi 7y ago
There was no reason to leave GitHub. People started boycotting GitHub before GitHub even did anything wrong.
- ekianjo 7y ago
  Github has tons of tracking.
- vunie 7y ago
  GitHub is unreliable: GitHub bases the decision of blocking projects on the subjectivity of moderators. Bellow are two cases I could recall (I'm sure there are more): 1. https://news.ycombinator.com/item?id=19182956 https://news.ycombinator.com/item?id=19182956 2. https://tech.slashdot.org/story/13/12/14/1618239/github-takes-down-satirical-c-plus-equality-language https://tech.slashdot.org/story/13/12/14/1618239/github-take... To me, not knowing when or why my software might be dropped is a fatal flaw for a service that exists to serve source code.
- kgwxd 7y ago
  People started boycotting GitHub when it became Microsoft, with decades of evidence to back it up.
- authoritarian 7y ago
  There have been, and continue to be, a variety of reasons to leave Github edit: Ah I see you work for Microsoft. In that case it's not surprising you are stating that there are no reasons to leave

lbotos 7y ago

I work at GitLab. Support Engineering Managers were briefed about this a few days ago. From inside GitLab Slack: 5d Scott Williamson We are not adding Pendo or Snowplow JS snippets to self hosted versions yet. That will likely come in a second phase of the project, and we will figure out opt in/opt out for those scenarios before launching. The reason we are communicating to those customers about it now is so we don't have to do the privacy policy change twice. So for now it's just .com customers. I will let @Tim Hey respond on where he would like discussion on this to go. 5d Support Engineer Thank you @Scott Williamson, I was hesitant to ping you as I know your time is valuable, but I'm glad that I did. :thank_you::thx::thankyou: 5d Tim Hey Hi @Support Engineer Looks like @Scott Williamson just beat me to the it. :sweat_smile: 5d Support Engineer You both are amazing and I can't thank you enough. 5d Tim Hey Also if you are interested in the being part of the discussion when we build out the opt in for scenarios like this I'd love to include you. I believe Lee was interested. 5d Support Engineer I'd love to be involved! If there's an opt-in or opt-out, it invalidates all the concerns I voiced here. Knowing this, I fully support the decision to add telemetry to self-managed and understand that it would be incredibly valuable for growth. 41m Support Engineer @Scott Williamson @Tim Hey @supportmanagers We have a lot of upset customers thinking that GitLab self-managed telemetry will be mandatory for Self-Managed GitLab moving forward (no opt-out/opt-in) . We need an official response and Zendesk template to help manage the influx

OnlineGladiator 7y ago
I am not sure it is a good idea to post internal slack conversations to a thread like this on HN.
- lbotos 7y ago
  I asked Scott, VP of Product, if he was okay with it. He was. In earnest, it should have been on an issue, so I could have linked to it directly.
deleted 7y ago
[deleted]
marcinzm 7y ago

Peckingjay 7y ago

edit: Comment no longer relevant since URL has been updated.

deleted 7y ago
[deleted]
dang 7y ago
We updated the URL above to that one. Before that it was https://gitlab.com/gitlab-org/gitaly/issues/2113 https://gitlab.com/gitlab-org/gitaly/issues/2113.
- YorickPeterse 7y ago
  Which has been moved to https://gitlab.com/gitlab-org/gitlab/issues/34833 https://gitlab.com/gitlab-org/gitlab/issues/34833, since it was using the wrong issue tracker before.
ahbyb 7y ago
That doesn't mean you have to edit what it said...
- Peckingjay 7y ago
  It was a copy paste of a section of the blog post now linked, nothing more.

jknoepfler 7y ago

How does this help gitlab's customers? (sincere question, my initial reaction has already been voiced here by others)

geofft 7y ago
Helps them see how people are actually using the product, what's difficult, what's popular, etc. And, of course, helps them make more money so they can hire more people/stay alive/etc.
- caiobegotti 7y ago
  How this being mandatory without opt-in help Gitlab users, more specifically?
emilycook 7y ago
Hello! Thanks for your feedback, because of it we added a section on our new issue about why we're doing this: https://gitlab.com/gitlab-org/growth/product/issues/164 https://gitlab.com/gitlab-org/growth/product/issues/164
jjgreen 7y ago
Heh, I read that as "How does this help gitlab's competitors?" and thought "isn't that obvious?"

victor9000 7y ago

Don't go down this road. The moment you place corporate needs ahead of user needs is the moment you start losing user advocates (UAs). New features are shiny objects that may attract interest, but UAs are your long-term lifeblood. They don't just use your product, they recommend it to friends, teams, bosses, and organizations. I'm not going to be as pessimistic as others in this thread bc I know you guys have what it takes to do the right thing. But know that a tide change has occurred when it comes to privacy and data, and technical folks are keenly aware of the importance of protecting both.

sytse 7y ago
I agree that user advocates are our lifeblood and we're risking alienating them. There were many more concerns than we expected. We’re going to process the feedback and rethink our plan. We will not activate product usage tracking on GitLab.com or GitLab self-managed before we address the feedback and re-evaluate our plan. We will make sure to communicate our proposed changes prior to any changes to GitLab.com or self-managed instances, and give sufficient time for people to provide feedback for a new proposal. We'll work in https://gitlab.com/gitlab-com/www-gitlab-com/issues/5672 https://gitlab.com/gitlab-com/www-gitlab-com/issues/5672
- apple4ever 7y ago
  > There were many more concerns than we expected. I really don't understand how this can be true. Just reading it briefly I knew there were going to be a ton of concerns.
  - patrickmn 7y ago
    Honestly, it's shocking that this came as a surprise. It's like they don't know why they made Gitlab self-hostable.
- jacquesm 7y ago
  > We will not activate product usage tracking on GitLab.com or GitLab self-managed before we address the feedback and re-evaluate our plan. I would like to see a harder commitment: to simply not do this. Gitlab does not have any credible reasons to add product usage tracking that does not have substantial downsides, better to steer clear of this completely.

jfkw 7y ago

From the article "... To make GitLab better faster, we need more data on how users are using GitLab. SaaS telemetry products, which provide analytics on user behavior inside web-based applications, have come a long way in the past few years. They are an important tool for rapidly improving user experiences because you can understand what users are doing (or not doing) in the app. GitLab has a lot of features, and a lot of users, and it is time that we use telemetry to get the data we need for our product managers to improve the experience." This doesn't seem like a sufficiently good justification add telemetry features which some users may find objectionable. Perhaps those resources would be better spent on a feature that let the user who is annoyed by a slow operation to: - Begin recording user interaction telemetry locally - Perform the slow or buggy operation - Stop recording, generating a data bundle file. - Allow the user to review the data bundle in human-readable format - Optionally take the data bundle to a less secured system as needed - Submit the data bundle to GitLab engineering as a well-filed issue Done that way, I think most users would welcome the interaction with Gitlab. For telemetry, not so much.

jkdufair 7y ago
That sounds like recipe for near-zero participation. I think both the intent and execution are spot-on here for GitLab. They are offering a very straightforward option for using GitLab, telemetry-free.
kazlock 7y ago
I'm not arguing for or against tracking, but I disagree with some of these assumptions: 1) 99% of users who have a bad experience are not going to be bothered to figure out how to record, review, and submit their session for the benefit of the service provider. If a page has issues loading, they're just going to give up and move on to the next thing. 2) User tracking isn't really related to performance in the first place. If some server side operation is failing or taking a long time to load, engineers will find out (and probably get paged) with user-agnostic internal performance metrics. 3) User tracking isn't just about finding out what's broken with the site, its about understanding how the site is being used in general so that you can validate your assumptions and make product decisions backed by data.

tgsovlerkhgsel 7y ago

> if you turn on Do Not Track in your browser, GitLab will not load the JavaScript snippet This is actually awesome, and a very rare thing as far as I can tell.

leeoniya 7y ago

they just keep rolling out the hits https://news.ycombinator.com/item?id=21274511 https://news.ycombinator.com/item?id=21274511

oedmarap 7y ago

> In order to service the needs of GitLab.com and GitLab Self-Managed users who do not want to be tracked, both GitLab.com and GitLab Self-Managed will honor the Do Not Track (DNT) mechanism in web browsers. This means that, if you turn on Do Not Track in your browser, GitLab will not load the JavaScript snippet. Ok so GitLab dotcom promises to honor DNT, which is good. > GitLab Community Edition will continue to be free software with no changes. So GitLab CE is not "affected" at all, which is better. I've never used the Enterprise Editions, but what's to stop enterprise ops/sysadmins from just blocking the third-party requests at the DNS level (regardless of the DNT promise)? Another HNer mentioned this re: air-gapped deployments. So in a purely practical sense, is the only noteworthy takeaway simply an extra production config step involving DNS?

kd3 7y ago

Going to be interesting to hear from the people who left Github for Gitlab when Microsoft took over.

throwawayofc2 7y ago

https://gitlab.com/gitlab-org/gitlab/issues/34833#note_234752308 https://gitlab.com/gitlab-org/gitlab/issues/34833#note_23475... For paying Gitlab customers, this sums up the general opinion well.

simpss 7y ago

this is a clear violation of GDPR, unless they can really guarantee the data is 100% anonymous, gitlab was able to provide the service without telemetry & is now blocking access to the (self-hosted) service unless one consents to the new data gathering practices. Best of all, 12.4 was released 2 days ago, the notification e-mail was sent out today...

emilycook 7y ago

Hi! GitLab employee here. We understand this is a topic that you all are concerned about, so we opened an issue to help clarify [1]. If you have any comments or concerns you’d like to relay back to us, you can do so there! We appreciate the feedback and want to be as transparent and accommodating as possible. [1] https://gitlab.com/gitlab-org/growth/product/issues/164 https://gitlab.com/gitlab-org/growth/product/issues/164

manbash 7y ago
Why is the following still open then? https://gitlab.com/gitlab-org/gitlab/issues/34833 https://gitlab.com/gitlab-org/gitlab/issues/34833 Are those not conflicting each other? Genuinely curious.
request136340 7y ago
> GitLab employee here. [..] If you have any comments or concerns you’d like to relay back to us, you can do so there! In order to leave the feedback "there", one has to accept new Terms of Service. Folks who refused new TOS can not log in... Just in case if not all GitLab employees realize how bad the situation is. But here's the feedback using HN, the user-friendly platform: Please add an option to "delete and erase account" button when user decides to decline the new TOS. https://news.ycombinator.com/item?id=21342650 https://news.ycombinator.com/item?id=21342650

gorkemcetin 7y ago

Out of curiosity Gitlabbers, have you thought about using an onpremises, self hosted product analytics/telemetry solution like Countly so that you don’t have to share PII data with a 3rd party? (disclaimer as usual: I work there).

couchand 7y ago

There was apparently months of internal discussion on this topic [0][1][2][3] (edit: particularly here [1.5] "It's not practical to send all of this metadata with every event, especially since we don't know what metadata we'll need ahead of time. In order to do anything beyond surface-level analysis, we need to be able to join on user_id."). In the end, the folks at the very top overruled the (relative) consensus that had been reached by Engineering, Product [4], and Compliance [5] that the tracking should only be done on an opt-in basis. Paul Machle, CFO, responding in no uncertain terms that the consensus was not acceptable: "I don’t understand. This should not be an opt in or an opt out. It is a condition of using our product. There is an acceptance of terms and the use of this data should be included in that." [6] The real juicy discussion seems to be on a private repo [7]. The final implementation plan [8] shows that tracking will be non-optional, including for self-hosted EE instances. [0]: https://gitlab.com/gitlab-org/gitlab-foss/issues/64341 https://gitlab.com/gitlab-org/gitlab-foss/issues/64341 [1]: https://gitlab.com/gitlab-org/telemetry/issues/57 https://gitlab.com/gitlab-org/telemetry/issues/57 [1.5]: https://gitlab.com/gitlab-org/telemetry/issues/57#note_190415032 https://gitlab.com/gitlab-org/telemetry/issues/57#note_19041... [2]: https://gitlab.com/gitlab-org/gitlab/merge_requests/14182 https://gitlab.com/gitlab-org/gitlab/merge_requests/14182 [3]: https://gitlab.com/gitlab-org/telemetry/issues/58 https://gitlab.com/gitlab-org/telemetry/issues/58 [4]: https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#note_203848357 https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#no... [5]: https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#note_185762038 https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#no... [6]: https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#note_203849107 https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#no... [7]: https://gitlab.com/gitlab-com/gl-security/compliance/compliance/issues/656 https://gitlab.com/gitlab-com/gl-security/compliance/complia... [8]: https://gitlab.com/groups/gitlab-org/-/epics/1937 https://gitlab.com/groups/gitlab-org/-/epics/1937

ktsmith 7y ago
> Paul Machle, CTO Paul is the CFO.
- couchand 7y ago
  facepalm thanks for the correction. Edited.

hajimuz 7y ago

Nobody really reads , not even smart hackers. That is my first thought after reading a lot of comments.

ivanjaros 7y ago

its funny how "spying" became "telemetry". you see it everywhere..and it seems to we working.

dijit 7y ago
Always beware those who try to control language. A recent (thankfully failed) example is Nigel Farage talking about a "No Deal" brexit as a "Clean Break" brexit. (sorry to bring up brexit, but it was a very recent example that sticks out in my mind)

raxxorrax 7y ago

I see that as a severely negative development and that opens a lot of room for competitors. I don't think you made the correct decision here, Gitlab.

kaffeemitsahne 7y ago

Data is the new crack. They just can't resist it.

trbfred 7y ago

... I felt quite confirmed while reading this. After months of thoughts and plans, I finally invested some hours to install Gitea on my Synology NAS and migrating all GitLab projects there. Combined with Synology Drive + Wireguard running on an EdgeRouter by Ubiquiti, this feels somehow good. Of course, just for my personal files that don't require collaboration with others ...

maxehmookau 7y ago

This is a bad move. Why not do what every other software package does and when you install it, ask if you want to "send anonymised information to help us improve the product". I now have to convince managers that GL is still safe to use and there's no data exfiltration risk!

account42 7y ago

So to make GitLab faster you are going to add more JS bloat. Ok.

the-dude 7y ago

I wonder if the remote-ness of the company has contributed to the out-of-touch-ness of this idea.

romanovcode 7y ago

Seems they are preparing for selling to Google!

sfwilliamson 7y ago

GitLab employee here. First of all, my apologies for the confusing messaging to our customer base. This change is only for our .com customers. We have not yet added instrumentation to the self-hosted Enterprise edition versions, and we will not do so until we have a way for self-hosted customers to easily control whether tracking is enabled in their environment. As an example, we currently have a feature called "usage ping" which sends back aggregate usage data, and self-hosted customers have the option to turn it off. We will continue to allow self-hosted customers to control the level of product usage data that is tracked in their environment, or turn it off completely. We also will not add tracking to the Community Edition, so that is always an option for customers. I want to reiterate that we are using this data to improve the product experience. Currently we are blind to what is being used in the product, how customers flow through the system, etc. Without this usage data it is very difficult to build a great customer experience.

aaxa 7y ago
And I guess you will make it opt-in instead of opt-out for the self-hosted Enterprise Edition, right? Edit: also, the email you sent out to your users is very different from your blog post. In the blog post you ask for feedback from your users, which is not the case in the email, which is written as an actual announcement that this is going to happen.
- sfwilliamson 7y ago
  We've heard your concerns and questions. There were many more concerns than we expected. We’re going to process the feedback and rethink our plan. We will not activate product usage tracking on GitLab.com or GitLab self-managed before we address the feedback and re-evaluate our plan. We will make sure to communicate our proposed changes prior to any changes to GitLab.com or self-managed instances, and give sufficient time for people to provide feedback for a new proposal. We'll work in this issue: https://gitlab.com/gitlab-com/www-gitlab-com/issues/5672 https://gitlab.com/gitlab-com/www-gitlab-com/issues/5672 Here's an MR updating our blog post accordingly: https://gitlab.com/gitlab-com/www-gitlab-com/merge_requests/33289/diffs#note_235139590 https://gitlab.com/gitlab-com/www-gitlab-com/merge_requests/...

dvtrn 7y ago

I've counted four different people who announced they work at Gitlab, in various different departments of the company. Appreciate you all showing up, on the one hand, when so many different roles are all showing up in a thread to offer justifications and explanations it looks very uncoordinated, this isn't a good look.

darkmarmot 7y ago

Well, looks like I no longer need to suggest we switch to Gitlab for our Fortune 100 :(

jrcii 7y ago

Ok so GitLab (who I’ve been rooting for for years) is evil now. Add to blacklist of organizations that prioritize money over respect for users. Got it.

munmaek 7y ago

Guess I’ll continue to self host Gitea and use SourceHut instead. Those are faster anyway.

dkersten 7y ago
Thanks for the suggestions! I'm going to start moving over.

rq1 7y ago

Hello! GitLab employee here... No just kidding.

authoritarian 7y ago

Looks like it's time to find a new service. This is very disappointing

simpss 7y ago

from gitlab: https://gitlab.com/gitlab-org/gitlab/issues/34833#note_235154077 https://gitlab.com/gitlab-org/gitlab/issues/34833#note_23515... ------------------ We've heard your concerns and questions. There were many more concerns than we expected. We’re going to process the feedback and rethink our plan. We will not activate product usage tracking on GitLab.com or GitLab self-managed before we address the feedback and re-evaluate our plan. We will make sure to communicate our proposed changes prior to any changes to GitLab.com or self-managed instances, and give sufficient time for people to provide feedback for a new proposal. We'll work in this issue.[1] Here's an MR updating our blog post accordingly: gitlab-com/www-gitlab-com!33289 (diffs, comment 235139590)[2] ------------------------- 1 - https://gitlab.com/gitlab-com/www-gitlab-com/issues/5672 https://gitlab.com/gitlab-com/www-gitlab-com/issues/5672 2 - https://gitlab.com/gitlab-com/www-gitlab-com/merge_requests/33289/diffs#note_235139590 https://gitlab.com/gitlab-com/www-gitlab-com/merge_requests/...

jagged-chisel 7y ago
Did we get a reversion to the older ToS with this?
- simpss 7y ago
  no concrete answer regarding that yet. I don't think the new ToS was published on gitlab.com already, so this might not be necessary. I asked the question to get a clear answer, probably won't hear anything back regarding this. edit: ToS has been rolled back as well: https://gitlab.com/gitlab-org/gitlab/issues/34833#note_235221218 https://gitlab.com/gitlab-org/gitlab/issues/34833#note_23522...

0xffff2 7y ago

I just deleted my Gitlab account. I'll be self-hosting personal projects from now on. It's clear that as an individual user of a third-party service you have virtually no control. No matter who you choose, the odds are that the owners of the service will eventually succumb to the siren song of VC money and sell their users' souls as a result.

deleted 7y ago

[deleted]

thsowers 7y ago

Additional discussion that is currently marked as a [dupe]: https://news.ycombinator.com/item?id=21343761 https://news.ycombinator.com/item?id=21343761

jammygit 7y ago

Seems like a good time to ask: who is using source hut? How do they find the email driven merge request process?

julienfr112 7y ago

Why send user data to third party ? Don't they have the man power to build a db with all the logs and maybe add that to a securing ml bullshit for Enterprise ?

jacquesm 7y ago

Don't ever do this. I'm a huge gitlab advocate and I'm already wondering if I should regret that. Keep in mind that one thing that keeps gitlab alive is that which it is not: github/microsoft. If you erase that boundary then there is no longer any good reason to recommend gitlab over github.