6 ms·

This is beyond stupid for GitLab. The _PAID_ self-hosted instances will have non-optional telemetry that loads remote javascript inside an enterprise? Any ent

This is beyond stupid for GitLab. The _PAID_ self-hosted instances will have non-optional telemetry that loads remote javascript inside an enterprise? Any enterprise that seriously wants to self-host will look at this statement and flip a table.

tgsovlerkhgsel 7y ago
No, they won't flip a table. They'll talk to the sales guy, tell him "nope", and will receive instructions how to turn it off.
- Aeolun 7y ago
  That is if anyone on the business end wants Gitlab, but that is almost never the case. The business has to be sold on Gitlab by the developers.
  - deleted 7y ago
    [deleted]
emilycook 7y ago
Hello! GitLab employee, I understand the frustration however self-hosted customers on EE will not be affected. We opened an issue here to help clarify: https://gitlab.com/gitlab-org/growth/product/issues/164 https://gitlab.com/gitlab-org/growth/product/issues/164
- Operyl 7y ago
  Wow the blog host reads poorly then, when I read “self-managed” I assumed managed by the customer, not Hosted Gitlab. You might want to clarify that in the post..
  - deleted 7y ago
    [deleted]
  - emilycook 7y ago
    We're testing this out on .com to see what value it really gives us and how it works, and depending on that then we might roll this out to EE. HOWEVER any move to do so will be properly communicated, and we're not going to implement it without carefully considering an appropriate opt-out strategy.
    - Operyl 7y ago
      Yeesh. You guys just went from restoring my faith a bit a few months ago to this possibility? I’m sorry, but please get a grip here, it’s tiring being on this rollercoaster.
    - Xelbair 7y ago
      as long as it is out-out, instead of opt-in, it probably won't fly with any corporation.
  - emilycook 7y ago
    edit: was trying to make a joke, it was a bad joke
    - Operyl 7y ago
      What..?
      - emilycook 7y ago
        I'm so sorry I was trying to make a joke, it's been a long day as the messenger trying to relay everyone's concerns about this back to our team.
        Operyl 7y ago
        I said "What..?" not because I didn't recognize the joke, but because nowhere did I bring up "security/privacy." My initial comment was stating that the blog post should clarify that these changes were not coming to EE immediately, because I (along with many others here) seem to have read it in such a way that it sounded like it was.
        emilycook 7y ago
        I hope I covered that in my other comment
    - TheAsprngHacker 7y ago
      As a disclaimer, I do not believe I've ever seen a captcha when logging in to GitLab. But according to https://docs.gitlab.com/ee/integration/recaptcha.html https://docs.gitlab.com/ee/integration/recaptcha.html, you use reCAPTCHA? Are you aware of the privacy concerns surrounding reCAPTCHA? https://en.wikipedia.org/wiki/ReCAPTCHA#Criticism https://en.wikipedia.org/wiki/ReCAPTCHA#Criticism
      - emilycook 7y ago
        I was just trying to make a joke I'm so sorry. As for recaptcha we have an issue here with a ton of discussion around it that links quite a few more if you're interested: https://gitlab.com/gitlab-org/gitlab-foss/issues/46548 https://gitlab.com/gitlab-org/gitlab-foss/issues/46548
- lolinder 7y ago
  To clarify your clarification, a quote from that issue: > We are not adding Pendo or Snowplow JS snippets to self-hosted versions at this time. We are carefully considering the appropriate opt-out functionality for telemetry that will work best for our customers, and we will clearly communicate to those customers when any change is made. In other words, it's not that self-hosted will not be affected, it's that self-hosted will not be affected yet. That's an important distinction.
  - pmoriarty 7y ago
    Also, why is it opt-out and not opt-in?
    - cpv 7y ago
      That's a trend going for years. A lot of services, newsletters, promo, telemetry, are by default opt-out. When you install some chat app, it also syncs some data (e.g. contacts maybe?) and then you can go in the settings and opt-out for that sync..
    - Xelbair 7y ago
      because with opt-out they can first gather the data and keep it before you can opt-out.
    - umvi 7y ago
      I'm guessing because opt in doesn't generate enough useful results while opt out does. Let's be real here, the difference between opt out and in is probably several orders of magnitude worth of data. It's like, would you rather have a Megabyte of telemetry to analyze or a Gigabyte?
      - joepie91_ 7y ago
        Except it does, if you have a sufficiently convincing reason for people to opt-in. Since a few weeks, our hackerspace - which used to publish all door unlocks on IRC with the nickname of the person unlocking it, by default - requires opt-in for nicknames to be published. People recognize that this is an important social function of the space, because it ties together the IRC channel and the physical space, and thus the vast majority(!) of members have explicitly opted in. This whole narrative that "if you make it opt-in, not enough people would ever do it" always conveniently leaves out that that's only true for things where people don't want to opt in, ie. usually things that benefit the service but not the users.
- antod 7y ago
  That clarification should explicitly address the original email that contradicted it (eg self managed EE would be getting telemetry).
- mch82 7y ago
  Opt-out (ideally opt-in) is very important for enterprise customers, especially self-hosted. Our enterprise security people would complain about data exfiltration risk. GitLab would only survive if the security people approve it & that is a LOT of extra work for the internal team that keeps GitLab sold within the company.
- jeltz 7y ago
  That does not mention anything about if I still have to agree to the new terms and conditions or not. Contrary to what you seem to think "at this time" is not very reassuring for me as a paying user.
- aj 7y ago
  I'm confused. Are you a Gitlab employee or are you addressing a Gitlab employee? Edit: From the parent commenters profile, it appears they are a Gitlab employee. The comment itself was confusing due to the comma after the Gitlab Employee
- jagged-chisel 7y ago
  > We are carefully considering the appropriate opt-out functionality for telemetry There's your problem. This should be entirely opt-in.
- ultraism 7y ago
  Will the opt-out be easily disabled during setup or will it be hidden in options?
sytse 7y ago
We made this blog post before implementing the changes so we could gather feedback. The feedback is very negative. And some of the things we thought would help (respecting DNT) don't seems to matter much. We'll have a look at all the feedback and see what we can learn and adjust.
- stunt 7y ago
  > We made this blog post before implementing the changes so we could gather feedback Blog post isn’t the best way to collect feedback. Just ask your customers directly. 10 bad title on internet is enough to screw your reputation on 10m developers that probably don’t even follow up the story or even don’t bother to read anything beyond Reddit titles and comments. But then you have 10m developers telling their managers “Oh Gitlab isn’t good”.
  - TeMPOraL 7y ago
    Totally. I got a link to this post sent to me today by a co-worker, and already in my mind I've blacklisted using Gitlab in an enterprise environment. It's only now that I found this thread on HN that I learned this isn't set in stone yet. But most people don't read HN.
    - sytse 7y ago
      I agree that the tone of the blog post was more like an announcement than a proposal.
- smartbit 7y ago
  Please do revert, Sytse. Look at how governments are fighting Microsoft's urge to track users [0] [1] We're in the process of taking a 50user Premium (aka self-hosted) GitLab subscription, don't make us reconsider and search alternative means. [0] https://edps.europa.eu/press-publications/press-news/press-releases/2019/edps-investigation-it-contracts-stronger_en https://edps.europa.eu/press-publications/press-news/press-r... [1] https://tweakers.net/nieuws/158892/ https://tweakers.net/nieuws/158892/
raxxorrax 7y ago
Enterprise Win 10 user here... uh, I am the bringer of bad news... Nevertheless I do think this is different since management defers decisions about software versioning and life-cycle management in general to developers. I do think this will cost them some hard earned customers. Certainly a bad move and I doubt it will amortize.
- dijit 7y ago
  I'm not sure how many people we employ. (more than 15k) and we're all using windows 10 without telemetry enabled. However, I'm relatively sure that this is due to the efforts of our very talented Windows Systems Administrators. Nonetheless, it's possible.

tgsovlerkhgsel 7y ago

No, they won't flip a table. They'll talk to the sales guy, tell him "nope", and will receive instructions how to turn it off.

Aeolun 7y ago
That is if anyone on the business end wants Gitlab, but that is almost never the case. The business has to be sold on Gitlab by the developers.
- deleted 7y ago
  [deleted]

emilycook 7y ago

Hello! GitLab employee, I understand the frustration however self-hosted customers on EE will not be affected. We opened an issue here to help clarify: https://gitlab.com/gitlab-org/growth/product/issues/164 https://gitlab.com/gitlab-org/growth/product/issues/164

Operyl 7y ago
Wow the blog host reads poorly then, when I read “self-managed” I assumed managed by the customer, not Hosted Gitlab. You might want to clarify that in the post..
- deleted 7y ago
  [deleted]
- emilycook 7y ago
  We're testing this out on .com to see what value it really gives us and how it works, and depending on that then we might roll this out to EE. HOWEVER any move to do so will be properly communicated, and we're not going to implement it without carefully considering an appropriate opt-out strategy.
  - Operyl 7y ago
    Yeesh. You guys just went from restoring my faith a bit a few months ago to this possibility? I’m sorry, but please get a grip here, it’s tiring being on this rollercoaster.
  - Xelbair 7y ago
    as long as it is out-out, instead of opt-in, it probably won't fly with any corporation.
- emilycook 7y ago
  edit: was trying to make a joke, it was a bad joke
  - Operyl 7y ago
    What..?
    - emilycook 7y ago
      I'm so sorry I was trying to make a joke, it's been a long day as the messenger trying to relay everyone's concerns about this back to our team.
      - Operyl 7y ago
        I said "What..?" not because I didn't recognize the joke, but because nowhere did I bring up "security/privacy." My initial comment was stating that the blog post should clarify that these changes were not coming to EE immediately, because I (along with many others here) seem to have read it in such a way that it sounded like it was.
        emilycook 7y ago
        I hope I covered that in my other comment
  - TheAsprngHacker 7y ago
    As a disclaimer, I do not believe I've ever seen a captcha when logging in to GitLab. But according to https://docs.gitlab.com/ee/integration/recaptcha.html https://docs.gitlab.com/ee/integration/recaptcha.html, you use reCAPTCHA? Are you aware of the privacy concerns surrounding reCAPTCHA? https://en.wikipedia.org/wiki/ReCAPTCHA#Criticism https://en.wikipedia.org/wiki/ReCAPTCHA#Criticism
    - emilycook 7y ago
      I was just trying to make a joke I'm so sorry. As for recaptcha we have an issue here with a ton of discussion around it that links quite a few more if you're interested: https://gitlab.com/gitlab-org/gitlab-foss/issues/46548 https://gitlab.com/gitlab-org/gitlab-foss/issues/46548
lolinder 7y ago
To clarify your clarification, a quote from that issue: > We are not adding Pendo or Snowplow JS snippets to self-hosted versions at this time. We are carefully considering the appropriate opt-out functionality for telemetry that will work best for our customers, and we will clearly communicate to those customers when any change is made. In other words, it's not that self-hosted will not be affected, it's that self-hosted will not be affected yet. That's an important distinction.
- pmoriarty 7y ago
  Also, why is it opt-out and not opt-in?
  - cpv 7y ago
    That's a trend going for years. A lot of services, newsletters, promo, telemetry, are by default opt-out. When you install some chat app, it also syncs some data (e.g. contacts maybe?) and then you can go in the settings and opt-out for that sync..
  - Xelbair 7y ago
    because with opt-out they can first gather the data and keep it before you can opt-out.
  - umvi 7y ago
    I'm guessing because opt in doesn't generate enough useful results while opt out does. Let's be real here, the difference between opt out and in is probably several orders of magnitude worth of data. It's like, would you rather have a Megabyte of telemetry to analyze or a Gigabyte?
    - joepie91_ 7y ago
      Except it does, if you have a sufficiently convincing reason for people to opt-in. Since a few weeks, our hackerspace - which used to publish all door unlocks on IRC with the nickname of the person unlocking it, by default - requires opt-in for nicknames to be published. People recognize that this is an important social function of the space, because it ties together the IRC channel and the physical space, and thus the vast majority(!) of members have explicitly opted in. This whole narrative that "if you make it opt-in, not enough people would ever do it" always conveniently leaves out that that's only true for things where people don't want to opt in, ie. usually things that benefit the service but not the users.
antod 7y ago
That clarification should explicitly address the original email that contradicted it (eg self managed EE would be getting telemetry).
mch82 7y ago
Opt-out (ideally opt-in) is very important for enterprise customers, especially self-hosted. Our enterprise security people would complain about data exfiltration risk. GitLab would only survive if the security people approve it & that is a LOT of extra work for the internal team that keeps GitLab sold within the company.
jeltz 7y ago
That does not mention anything about if I still have to agree to the new terms and conditions or not. Contrary to what you seem to think "at this time" is not very reassuring for me as a paying user.
aj 7y ago
I'm confused. Are you a Gitlab employee or are you addressing a Gitlab employee? Edit: From the parent commenters profile, it appears they are a Gitlab employee. The comment itself was confusing due to the comma after the Gitlab Employee
jagged-chisel 7y ago
> We are carefully considering the appropriate opt-out functionality for telemetry There's your problem. This should be entirely opt-in.
ultraism 7y ago
Will the opt-out be easily disabled during setup or will it be hidden in options?

sytse 7y ago

We made this blog post before implementing the changes so we could gather feedback. The feedback is very negative. And some of the things we thought would help (respecting DNT) don't seems to matter much. We'll have a look at all the feedback and see what we can learn and adjust.

stunt 7y ago
> We made this blog post before implementing the changes so we could gather feedback Blog post isn’t the best way to collect feedback. Just ask your customers directly. 10 bad title on internet is enough to screw your reputation on 10m developers that probably don’t even follow up the story or even don’t bother to read anything beyond Reddit titles and comments. But then you have 10m developers telling their managers “Oh Gitlab isn’t good”.
- TeMPOraL 7y ago
  Totally. I got a link to this post sent to me today by a co-worker, and already in my mind I've blacklisted using Gitlab in an enterprise environment. It's only now that I found this thread on HN that I learned this isn't set in stone yet. But most people don't read HN.
  - sytse 7y ago
    I agree that the tone of the blog post was more like an announcement than a proposal.
smartbit 7y ago
Please do revert, Sytse. Look at how governments are fighting Microsoft's urge to track users [0] [1] We're in the process of taking a 50user Premium (aka self-hosted) GitLab subscription, don't make us reconsider and search alternative means. [0] https://edps.europa.eu/press-publications/press-news/press-releases/2019/edps-investigation-it-contracts-stronger_en https://edps.europa.eu/press-publications/press-news/press-r... [1] https://tweakers.net/nieuws/158892/ https://tweakers.net/nieuws/158892/

raxxorrax 7y ago

Enterprise Win 10 user here... uh, I am the bringer of bad news... Nevertheless I do think this is different since management defers decisions about software versioning and life-cycle management in general to developers. I do think this will cost them some hard earned customers. Certainly a bad move and I doubt it will amortize.

dijit 7y ago
I'm not sure how many people we employ. (more than 15k) and we're all using windows 10 without telemetry enabled. However, I'm relatively sure that this is due to the efforts of our very talented Windows Systems Administrators. Nonetheless, it's possible.