54 ms·

Gitlab ‘rethinking’ third-party telemetry

• ehutch79 7y ago
  I don't really see the issue. If you're already storing all your code on a third party service, why is it suddenly horrible that they're doing event tracking on the use of the service? If you REALLY cared, wouldn't you be self hosting anyways?
  • luckylion 7y ago
    > If you REALLY cared, wouldn't you be self hosting anyways? Initially, they said they'd infect the self-hosted EE versions too. I'm pretty sure that server-side analytics ("there were 1000 calls to this API endpoint") is considered very different from client-side analytics via marketing/ad-tech tracking companies.
  • jeltz 7y ago
    But I am self hosting just for this reason and got an email yesterday which said I needed to agree to let them add tracking to my self hosted instance. Fuck no!
• tannhaeuser 7y ago
  Going to github isn't better I guess, or has a bad outlook at least with MS's lust for "telemetry". Last I checked, they blocked indie search crawlers.
  • rvz 7y ago
    The recent Github repository exodus has now been in vain since GitLab is taking action similar to how MS is famous in developer circles for telemetry and not respecting your privacy. Whenever VCs are involved, the community always finishes last. For individuals sourcehut[0] may seem to be an alternative. Open source orgs might be better of self-hosting. In either scenario I would rather go with the community than to be in the mercy of a VC-backed corporation for hosting my work in this case. [0] https://sr.ht https://sr.ht
  • tannhaeuser 7y ago
    Employees of GitHub: tell me where I'm wrong, don't just downvote me. This is a serious discussion we need to be having.
    • arkitaip 7y ago
      Very disturbing that this is a discussion you need to have now as opposed to already knowing this considering how privacy sensitive the dev community has always been.
  • weaksauce 7y ago
    If you use something like ublock origin to block the third party telemetry scripts on github I don’t think it breaks the rest of the site no?
• bryanlarsen 7y ago
  dupe: https://news.ycombinator.com/item?id=21337594 https://news.ycombinator.com/item?id=21337594
  • thsowers 7y ago
    @dang, can you merge these threads instead of having this one marked as a [dupe] and hidden?
    • dang 7y ago
      Working on it.
  • falcolas 7y ago
    /feedbackhn It really sucks when an active discussion on the front page is nuked in favor of a dead discussion on an article that's ready to fall off the second page.
    • thsowers 7y ago
      Some conspiratorial minds might even suggest that this may of been intentional seeing that GitLab is a member of Y Combinator
      • dang 7y ago
        The first rule of HN moderation is to moderate less, not more, when YC startups are at issue: https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=by%3Adang%20moderate%20less%20not%20more%20yc&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu... That doesn't mean we don't moderate at all, just less. For example, in this case, the repost was obviously a dupe by a large margin, so we marked it as a dupe. But when people complained about that, we were more likely to bend the rules because Gitlab is a YC startup. If it were an unrelated company, we would have been more likely to say something like "look you guys, this is standard practice and it's not a borderline call" and left the repost marked as a duplicate.
• deleted 7y ago
  [deleted]
• btasovac 7y ago
  Hello all, GitLabber here! We opened an issue for gathering feedback at https://gitlab.com/gitlab-org/growth/product/issues/164 https://gitlab.com/gitlab-org/growth/product/issues/164 and you can find the most up to date information regarding this topic there. Please join the discussion and let us know what you think.
  • LamaOfRuin 7y ago
    I don't believe that requiring explicit agreement to a new ToS before being able to access account deletion is kosher.
    • emilycook 7y ago
      The ToS have been rolled back, and telemetry had not been implemented yet. I (of course) don't want anyone to leave, but hopefully that alleviates any concerns if people want to.
  • teraflop 7y ago
    You say "discussion", but many of the Gitlab developer comments in that thread consist of the same response copy-and-pasted verbatim in response to multiple different people, which comes across more as PR spin than as a good-faith attempt to engage in a discussion.
    • jrcii 7y ago
      Why would there be a “discussion”? They knew their users didn’t want this anti-feature before they implemented it and they did it anyway. Then they add insult to injury by pretending to “discuss” it as if user consent or participation has anything to do with this.
      • emilycook 7y ago
        We have been taking the feedback seriously, we rolled back our ToS changes and are reconsidering our approach here. More info can be found on the issue
• atonse 7y ago
  If these trackers are blocked by our content blockers or PiHole, will Gitlab stop working?
  • crdrost 7y ago
    Apparently not, but the linked page does mention that this necessitated a change to their ToS and until you accept the ToS the API stops working. I don’t think they’re trying to associate your identity with other web traffic the way normal “trackers” do, but just to have a client-side view of a browser session: what did you click on in which order in a typical session, what features are unused and what needs to be boosted to the dashboard pages of your repository, etc. Especially when backend calls can be triggered from multiple frontend locations, this sort of information can be really helpful.
    • atonse 7y ago
      I agree that they just want telemetry on how we use the apps. As a developer, I'd love that kind of telemetry too. I think what most people are complaining about is the third-party. If, say, Gitlab hosted their own telemetry services (on their servers, accessible to their product managers, etc), I doubt there would be so much backlash.
      • emilycook 7y ago
        GitLab employee, some employees have proposed this idea and (speaking personally) I think it would be a better approach. We've halted movement on using telemetry and are reconsidering. More info is on this issue: https://gitlab.com/gitlab-org/growth/product/issues/164 https://gitlab.com/gitlab-org/growth/product/issues/164
    • jahlove 7y ago
      Apparently not? This is what a Gitlabber said in the original thread when someone asked about it working in air gapped environments [1]: > I work at GitLab in Support Engineering I'm talking with product now about this. We raised this when the conversation started as a concern, and I want you to know that internally I am advocating that it _doesn't_. They would not need to "advocate" for it to continue working if that were teh case. [1] https://news.ycombinator.com/item?id=21339266 https://news.ycombinator.com/item?id=21339266
• StavrosK 7y ago
  As others have noted in the thread, this is quite illegal in the EU (telemetry should be opt-in, not opt-out). I'd like to see how they tackle that one.
  • Wowfunhappy 7y ago
    Is basically anyone actually doing this? Legitimate question. It doesn't make it okay, but as far as I can tell almost no one is actually following GDPR, despite the large theoretical penalties. They've all decided to just put up cookie notices (with dark patterns to elicit agreement), because it's easy and doesn't force fundamental changes to business practices.
    • StavrosK 7y ago
      No, not yet. I'm guessing they'll start after we see the first big lawsuits, we're still in an adjustment period.
    • wlll 7y ago
      Yeah, lots of sites are GDPR compliant, it's just more noticable when the hard to understand cookie pop up is used.
    • vector_spaces 7y ago
      The penalties aren't just theoretical -- see this list of actual enforcements http://enforcementtracker.com/ http://enforcementtracker.com/
      • Wowfunhappy 7y ago
        Well, something isn't working if Amazon, Google, Microsoft, and now Gitlab are all still breaking the law.
        • vector_spaces 7y ago
          Yeah -- Google was fined too, but the sum is effectively peanuts for them https://www.nytimes.com/2019/01/21/technology/google-europe-gdpr-fine.html https://www.nytimes.com/2019/01/21/technology/google-europe-...
• breadandcrumbel 7y ago
  From their related blog post: “In order to service the needs of GitLab.com and GitLab Self-Managed users who do not want to be tracked, both GitLab.com and GitLab Self-Managed will honor the Do Not Track (DNT) mechanism in web browsers. This means that, if you turn on Do Not Track in your browser, GitLab will not load the JavaScript snippet.”
• yk 7y ago
  Between this and their new moderation policy, I suspect they will announce classic coke soon.
• atonse 7y ago
  Do Not Track was removed from Safari. Nobody really honored it so it's become one of those features that just died on the vine. So what are Safari users supposed to do, to opt out?
  • deleted 7y ago
    [deleted]
  • _-___________-_ 7y ago
    Honestly, use something that actually blocks the trackers, rather than just asking the trackers nicely not to track you. Switch browsers if you have to. Turning on DNT is like walking around a big city wearing a cap that says "Please don't record CCTV pictures of me."
    • antisemiotic 7y ago
      DNT is pretty much the reverse of the evil bit (RFC 3514), but supposedly not meant as a joke.
  • rocky1138 7y ago
    Ask Apple to put it back. And ask Apple to put pressure on services to support it. They're a large fish and we'd all appreciate them helping out.
• CameronBanga 7y ago
  I've been a huge Gitlab supporter for the past 5 years, and we have all of our repos there. Have had their paid service for a while. This feels gross, and I'm going to look at moving.
  • Aeolun 7y ago
    Yeah, that was my feeling as well. I can forgive them for being careless enough to delete their production database (2 years ago?), but not for the dysfunction in the company that was necessary for this debacle to happen.
• staz 7y ago
  > So, for users who have integrations with our API this will cause a brief pause in service via our API until the terms have been accepted by signing in to the web interface. What a fucking botched way to do this. Breaking all automation at a moment notice. They should have announced the change long ago. Make an advance clear deadline for accepting the ToS and then after the deadline blocked the API.
  • Frost1x 7y ago
    These are the sort of stunts that happen when you relinquish more and more control of your technology and its ownership to external sources that also happen to be for-profit businesses. All hail EaaS (Everything-as-a-Service) models. I entirely agree with you and your sentiments, but I'm not sure why many are even remotely surprised by these sort of escapades. The more dependent you are on an external business for some function and the more that business realizes it, the more they're going to use their leverage against you to their advantage to achieve their goals (not yours). That's exactly what we see happening here. When businesses (or any entities) buy-in to external resources like this, always consider: how much leverage those managing that resource have against you, how critical the function is for you, and how many resources it will take to migrate away from that external resource at a moment's notice if you need to. This is a continuous iterative process that should be going through every developer's head with every design choice, external license, "cloud" service, proprietary internally hosted licenses, etc.
    • BurningFrog 7y ago
      > ....external sources that also happen to be for-profit businesses. Pretty sure a not for profit organization would have even less interest in pleasing their users.
      • ChristianBundy 7y ago
        Maybe, but a cooperatively owned and managed business would have complete interest in its members and their values.
      • 7y ago
• amluto 7y ago
  The negative comments seem largely focused on issues with telemetry per se (which is a big deal, especially in the enterprise), but, for my company, I see an even bigger problem. There is no way that I would host a solution that includes third-party scripts. This is simply not negotiable. I don't care how good that third party's "data protection" is -- the ability to serve up that script means that anyone who compromises the third party, even just a temporary compromise of their front end, has the keys to the kingdom. If you want to collect telemetry, fine. Do it on a first-party basis, distill it down into one file a month, and let admins upload it if they like. But the third-party script is a complete nonstarter.
  • raxxorrax 7y ago
    > let admins upload it if they like If that was the approach to telemetry, I think most users wouldn't have a problem. But currently the word alone makes us rethink about using the product at all.
    • ocdtrekkie 7y ago
      Indeed. Back when Windows asked me if I wanted to send info about an error to Microsoft so they could improve Windows, I pretty much instinctively clicked yes. Now that they collect the information without my permission, I block it at the network level.
  • apocalyptic0n3 7y ago
    > There is no way that I would host a solution that includes third-party scripts. At least for now, it appears that the self-hosted versions of GitLab (both CE and EE) will not be getting telemetry scripts. This is only for gitlab.com (again, for now). See the table on their ticket[1] for the issue 1: https://gitlab.com/gitlab-org/growth/product/issues/164 https://gitlab.com/gitlab-org/growth/product/issues/164
    • jka 7y ago
      From that link, it doesn't exactly sound like they've ruled out the possibility of adding this tracking to EE too however - and reading between the lines, it sounds like they'd prefer telemetry to be enabled by default if & when that does happen? We are not adding Pendo or Snowplow JS snippets to self-hosted versions at this time. We are carefully considering the appropriate opt-out functionality for telemetry that will work best for our customers, and we will clearly communicate to those customers when any change is made.
• sytse 7y ago
  The feedback to this change is very negative. And some of the things we thought would help (respecting DNT) don't seems to matter much. We'll have a look at all the feedback and see what we can learn and adjust. First change to the blog post is in https://gitlab.com/gitlab-com/www-gitlab-com/merge_requests/33278/diffs https://gitlab.com/gitlab-com/www-gitlab-com/merge_requests/... and we're discussing more changes.
  • thsowers 7y ago
    Not sure why the "opt-in" option isnt more apparent as a less hostile UX? I've always thought of Gitlab as a privacy minded company, until now, and the botched attempts to listen to feedback are only worsening my impression. Please prove me wrong!
    • sytse 7y ago
      "Not sure why the "opt-in" option isnt more apparent as a less hostile UX?" do you mean having to use DNT to opt out?
      • thsowers 7y ago
        No, I mean opt-in to telemetry as opposed to having to opt-out would be more ideal
      • _-___________-_ 7y ago
        Not all browsers make it easy to turn DNT on (Safari has apparently removed it), so it's not an ideal opt-out mechanism. DNT is basically a failed technology; if you really care about not being tracked you would just block the trackers rather than asking them to pretty please not track you. (Edited to add: as others have said, this should not be opt-out anyway. Opt-in is much less user hostile, and as far as I know is legally mandated in the EU anyway.)
      • wastedhours 7y ago
        The issue is forcing this as "opt-out" rather than "opt-in". Opt-out is pretty hostile UX for something you must have known would be seen as a negative by large swathes of the developer audience (and if you didn't see the negative reaction coming, then there's larger questions to be asked). I'm a free user, so I'm "happy" insofar as I have very little say, but it's certainly a worrying step.
• Wowfunhappy 7y ago
  The submission title should be "Important Updates to our Terms of Service and Telemetry Services". As important as this is, the editorialization is quite clearly against HN guidelines.
  • ralmeida 7y ago
    Not sure this would be fully editorializing, since the updated title (currently "Gitlab mandating third-party telemetry, locks out user access until accepted") is objectively factual and true.
    • Wowfunhappy 7y ago
      It's not about what's factual, the guidelines are pretty clear: > Please use the original title, unless it is misleading or linkbait; don't editorialize.
      • ralmeida 7y ago
        I totally get where you're coming from, but the full sentence is: > Otherwise [outside a set of very specific circumstances], please use the original title, unless it is misleading or linkbait; don't editorialize. I'm not sure what would count as "specific circumstances". One could argue though that the original title was "editorialized", since GitLab has an incentive to soften the blow of the news, especially since the original title doesn't tell much about the news itself (what is the important update)?
        • Wowfunhappy 7y ago
          Specific circumstances as in, what's in the paragraphs above. The exceptions are (1) if the title includes the name of the site or (2) if the title begins with a number. Neither apply here.
          • ralmeida 7y ago
            Well, I guess that would be open to interpretation - I don't get from the sentence that the "very specific circumstances" refer exclusively to the paragraphs above. Otherwise, they would have written "outside the circumstances mentioned above" or omitted the brackets entirely, IMO. I believe they phrased it this way so some discretion can be exercised if the original title doesn't give the full context. Another example is the recent Tesla story - original title is "Q3 2019 Update", story title is "Tesla Q3 Financial Results". The HN story for when MS bought GitHub is "Microsoft acquires GitHub", while original title was "Microsoft + GitHub = Empowering Developers". If there wasn't such a leeway, most acquisition stories would be titled "Our incredible journey".
• deleted 7y ago
  [deleted]
• olafure 7y ago
  Just wanted to point out Gogs: https://gogs.io/ https://gogs.io/ It's a very light weight, self-hosted git server, the UI is very GitHub like. It's not a replacement for all the features of a self-hosted GitLab. But I've seen people battling a self-hosted GitLab instance when all they needed was something like Gogs.
  • raxxorrax 7y ago
    Looks interesting. As if they had stolen all the CSS files from GitHub. Gitea is also nice self-host option, but also not a complete ALM solution. We often use trac in conjunction with different source control providers, which might be ancient by now, but it always delivers and everyone seems to like it.
    • vips7L 7y ago
      Gitea is a fork of gogs.
    • sp332 7y ago
      ALM?
      • rapnie 7y ago
        application lifecycle management
    • jawngee 7y ago
      Can you really steal CSS though?
      • weaksauce 7y ago
        i mean the design of it is almost a carbon copy of the github design down to the layout, design, and colors. https://i.imgur.com/rFbaEkL.png https://i.imgur.com/rFbaEkL.png if i replaced just the logo in the upper left hand corner to the github logo instead of the googs logo would you be able to tell the difference between this screenshot and github proper?
• vezycash 7y ago
  This is one of the "perks" of VC money.
  • umvi 7y ago
    Any company that accepts VC, goes public, etc, eventually resorts to aggressive telemetry and doing business with China. It's practically guaranteed at this point.
• zygimantasdev 7y ago
  Gitlab reputation went down quite a bit from my perspective. No time given to migrate.
• kimjongtrill 7y ago
  what the fuck are Gitlab doing recently?! smh.
• antoineMoPa 7y ago
  You can't measure something without impacting it. Adding spyware to products make them slower. Here is an alternative solution I begun using for one of my projects: There is no telemetry like grep in nginx logs with carefully fetch()'ed paths. Put this in JS code: fetch("/stats/user_used_feature_x") fetch("/stats/user_reached_checkout_step_3") etc. Then you can find the information you need with: grep -o ".*/stats/[a-z_]*" /var/log/nginx/access.log Now you can count how many users reach features and checkout steps. That is dozens of time more performant than using third party scripts. No extra library.
  • ComodoHacker 7y ago
    Yeah, but they want heatmaps and attention spans. Optionally eye tracking, if camera is available.
• danielovichdk 7y ago
  Hahahahaha. I remember all the fuzz about MS buying github and perhaps forcing telemetry. Something along those lines. People were so fast to live their stuff to Gitlab without bothering thinking about that business is business. These fucking corporations or wannabe corporations doesn't give a fuck about you or your data. That's the fundamental mindset you need to have when sending them money for services. Ain't no such thing as halfway crooks.
  • sciurus 7y ago
    Github is already collecting limited client-side telemetry. Open the network tab in your developer tools and you'll see a request to collector.githubapp.com on every page load that includes details like your screen resolution.
    • frenchman99 7y ago
      If they collect it themselves, without 3rd party script, it's more secure than including 3rd party scripts in the page, which is what Gitlab seems to want to do.
    • bhauer 7y ago
      Sidebar good news for anyone reading this: Since they use a different hostname that doesn't host any operational functionality, namely collector.githubapp.com, that host is already included in most DNS blocklists.
    • Dirlewanger 7y ago
      Also, who knows what else they collect about you on the backend? I find it funny that people sometimes make such a fuss about front end metrics when they could be collecting way more on the back end (especially so if it's a closed source platform like GitHub, at least with Gitlab, I can look at the back end code and see what they're collecting).
  • oneepic 7y ago
    > These fucking corporations or wannabe corporations doesn't give a fuck about you Thanks for the redpill. /s I would however say that they had a good rep until now, in general, so perhaps they will reconsider if there's enough backlash.
• thrownaway954 7y ago
  Yep... and everyone was bashing Github last month and praising Gitlab. My my... how quickly the tides have changed.
  • eeZah7Ux 7y ago
    everyone praising Gitlab? No, not at all.
• paglia_s 7y ago
  Something I have noticed several times and I can’t understand from an EU perspective is this: in the US a company you have a contract with (ie a company you are paying for a service for a certain amount of time) can change their tos / contract with you without prior notice and without having to at least honor the previous agreement until your current billing period expires? For example if I paid for 1 year, I would expect the contract available at the time of payment should apply for the entire year or offer a refund if you don’t want to accept the changes. And always with at least two weeks of notice
  • mnw21cam 7y ago
    I am altering the deal. Pray I don't alter it any further.
  • Mathnerd314 7y ago
    Usually they have a clause in the contract stating that they can change the terms. Github provides 30 days notice, Gitlab has an email with instant effect and a vague thing about checking their website. I've seen sketchier companies who have instant changes w/ no notice and that state their published TOS is inaccurate.
• ngcc_hk 7y ago
  wow what a mess
• BurningFrog 7y ago
  I'll be uncool one who asks: What does "telemetry" mean in this context? What is GL actually demanding of its users, and why?
  • overgard 7y ago
    For gitlab it probably means getting information on what buttons are pressed, how long users stay on a page, etc. For users, it means running proprietary javascript snippets from 3rd party tracking services. How much should you trust that code? You may trust gitlab, but do you trust the vendors they work with? How much visibility do you have into that? As you can imagine, a lot of businesses are not willing to take that risk with trade secrets like source code and internal bug tracking -- especially when there's no upside to them. I think the furor is probably less about the data being collected (although people aren't happy about that), and more that Gitlab just offloaded a lot of risk on their users for purely selfish reasons. (And it is selfish. They can get the data in other ways, or, make decisions based on expertise and customer feedback instead. You don't need a mountain of data to drive a product).
    • BurningFrog 7y ago
      Thanks. I genuinely didn't know. Looks like the anger is also a lot about this being sprung overnight with no warning. > trade secrets like source code Don't Gitlab already have their source code?
      • bdcravens 7y ago
        > Don't Gitlab already have their source code? Yes. The point is third-parties now can.
      • rswail 7y ago
        Not if you host it on-prem/on-your-servers
• SifJar 7y ago
  https://sourcehut.org/blog/2019-10-23-srht-puts-users-first/ https://sourcehut.org/blog/2019-10-23-srht-puts-users-first/
• alangibson 7y ago
  This is incredible seeing how people were moving to Gitlab as a not-owned-by-Microsoft alternative to GitHub. I remember when Microsoft was just M$, and now the look like the good guys.
• 0vermorrow 7y ago
  The pushback from users made them rethink this change, here's a pending merge request to the blogpost: https://gitlab.com/gitlab-com/www-gitlab-com/merge_requests/33289/diffs https://gitlab.com/gitlab-com/www-gitlab-com/merge_requests/... """ UPDATE: Thanks for the feedback. There were many more concerns than we expected. We’re going to process the feedback and rethink our plan. We will not activate product usage tracking on GitLab.com or GitLab self-managed for now. We'll make sure to communicate in advance on our blog when we do have a new plan. """
  • dorian-graph 7y ago
    > There were many more concerns than we expected. So they expected some, but still went ahead anyway?
    • jcims 7y ago
      Nothing wrong with that in general, you can't make everyone happy.
    • toflon 7y ago
      There will always be concerns from some people. Always.
    • skywhopper 7y ago
      There will always be concerns and complaints. I'm more surprised they didn't expect a firestorm given the way they explained the change, though. I wonder how many people actually reviewed the language.
  • ianamartin 7y ago
    You can tell a company has totally lost their heads up their asses when you get the, "Whoa! We totally weren't expecting <product decision> to upset so many people!" Like really? Considering what people use your product for, you honestly didn't expect this to upset people? Great. Your product team is hopelessly out of touch.
    • 7y ago
• jancsika 7y ago
  > Again, there will be no changes to GitLab CE. So it doesn't affect me directly. Someone who is affected-- tell me what change this company is making that you don't like. No theorizing, please. Only bona fide gitlab.com users need reply.
  • CrazyStat 7y ago
    Gitlab plans (planned, as of this writing) to load third-party telemetry scripts which will necessarily have access to all the content of any page they are used on. This opens an additional attack vector that anyone hosting valuable IP on gitlab.com or the self-hosted enterprise edition needs to worry about.
• deleted 7y ago
  [deleted]
• annoyingnoob 7y ago
  Gitlab just posted an update that they are going to process the feedback and rethink the feature here. Nice to see a heads-up move like that - I was ready to drop Gitlab like a hot rock.
  • JohnFen 7y ago
    > I was ready to drop Gitlab like a hot rock. I am dropping Gitlab like a hot rock. The way they did this initially, and the responses that I've been reading here and on Gitlab, don't reassure me at all.
  • paintstripper 7y ago
    They won't rethink it, they'll just wait until this blows over then implement it silently. They haven't changed the TOS back yet.
• tyfon 7y ago
  Anyone figure out how to delete the account without accepting these terms? I can't even log in without getting the "Concent or logout" bullshit. What they do here is highly questionable in regards to GDPR, I'm reporting this to my local authorities.
  • JohnFen 7y ago
    Honestly, if what you want to do is delete your account, I don't see a problem with going ahead and accepting the new terms. Then they'll have telemetry covering what you did during the account deletion process. Once your account is deleted, that consent becomes a total nonissue.
    • rossmohax 7y ago
      it is more complicated than that, data without user_ids was already collected, but it wasn't possible to link them to accounts on gitlab side. the moment you accept new terms, single telemetry event sent allows to links all past events to your gitlab account. Source: https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#note_182299396 https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#no...
      • JohnFen 7y ago
        True enough. But (assuming they actually implement this in this way), there's nothing much that can be done about it aside from acknowledge that trusting them was a mistake. You could always just abandon the account and never use it again, I suppose.
  • emilycook 7y ago
    We've rolled back the ToS update and had not implemented telemetry yet, we're reconsidering our plan based on the feedback. More info and further discussion can be found here: https://gitlab.com/gitlab-org/growth/product/issues/164 https://gitlab.com/gitlab-org/growth/product/issues/164
• JohnFen 7y ago
  Well, Gitlab is now unacceptable for my use. It also appears that Gitlab really is all-in on this telemetry stuff, as they envision "telemetry-as-a-service": https://about.gitlab.com/direction/telemetry/collection/ https://about.gitlab.com/direction/telemetry/collection/
  • emilycook 7y ago
    We're halting any movement on this and reconsidering our decision on telemetry, you can find more information here: https://gitlab.com/gitlab-org/growth/product/issues/164 https://gitlab.com/gitlab-org/growth/product/issues/164
    • deleted 7y ago
      [deleted]
    • JohnFen 7y ago
      Yes, I'm well aware of that, and I give credit to Gitlab for being willing to back-peddle in the face of user outcry. But the way that this was rolled out was egregious enough that I don't have much trust in Gitlab at the moment.
• deleted 7y ago
  [deleted]
• esotericn 7y ago
  "Trust takes years to build, seconds to break, and forever to repair". Why is this so important? It's important because a lot of that trust is ideological. I trust that the developers of 'git' itself won't be adding telemetry behind the scenes. I trust that the developers of 'cgit' won't be adding this stuff. Because we're on the same page; despite the fact that theoretically the next commit that hits the repo could be the one that sends my keystrokes. The first time you pull this sort of stunt you've instantly erased all of that good will and now you're forcing people to comb through your releases and conditions with fine teeth because you've shown yourself to act against user interests. This doesn't scale. That's why the backlash is bigger than you expect, not necessarily because of the magnitude of the change, but because you've positioned yourself as a threat.
• pjmlp 7y ago
  The irony is that this is the company everyone jumped into because big bad Microsoft acquired GitHub. When will people learn that corporations are about money?
  • umvi 7y ago
    Corporations beholden to VC, shareholders, etc. are all about growth at any cost (ethical or otherwise). Private companies don't have this problem.
    • pjmlp 7y ago
      Private companies also need to be profitable, otherwise they would be charities.
      • umvi 7y ago
        Right, but you can stay profitable without the need for hockey stick growth
• atonse 7y ago
  It’s difficult for some of us that host 20+ Repos and use all the related tools. I’m going to try the ad blocker route first.
• EGreg 7y ago
  Can someone explain what this telemetry does and what its role is supposed to be?
  • bdcravens 7y ago
    Likely to capture user behavior (click this button, type in this field, hover over that link, etc). Can influence changes to UX.
• ianamartin 7y ago
  https://sourcehut.org https://sourcehut.org is looking better and better all the time.
• JohnCClarke 7y ago
  Honest question for the people who feel strongly about telemetry: What is/are your concern/s?
  • vpEfljFL 7y ago
    You are welcome. Send your browsing history for the last 24h please as a reply and we can talk why users (especially tech savvy) don't like telemetry.
• ptah 7y ago
  Can brave block these js calls
• chris_wot 7y ago
  That’s the wrong bug report now - try https://gitlab.com/gitlab-org/gitlab/issues/34833 https://gitlab.com/gitlab-org/gitlab/issues/34833
• onli 7y ago
  There are so many issues in play here. Some plain legal, others based on expectations. 1. DSGVO means opt-in when collecting private information not necessary for the usage of the product (and even then it's dicey). Making the use of your product dependent on accepting private information gathering is illegal. DNT is logically a valid way to opt-out (apart from browsers dropping the feature and users not knowing about it), but that's not enough here. It would be different if DNT was enabled by default (I assume), but all browser makers dropped the ball here years ago. 2. You built a reputation of the people's git provider, albeit in conflict with the completely free alternatives. And now you make a post "we will change it, you have to accept the new TOS, and there will be a service interruption", like a generic US company might do. It's unfitting to you. It does not matter that the products concerned are not free. 3. The right solution exists and would not hurt you. I assume you want telemetry data to improve the product (if not the issue is even bigger). So you add that option and ask them whether he would be okay to activate it, like Mozilla is doing in products like Firefox. This scheme works and data gets collected anyway, a bit less, but that should not be an issue. Careful: Admins must be able to remove the prompt for all their users if it arrives in the self-hosted products. 4. Pick a data collection destination that is the least controversial. In your case that should be inhouse. Alternative might be a privacy focused organization in Europe, but it has to be known to your customers. 5. If you think DSGVO does not apply to you realize that it does not really matter since the sensible parts of it are also the ethical correct way. So in any case it is good to follow the spirit of it. 6. Note also how matter of fact and corporate the language used in the blog post is. That can only worsen the impact on those that care about you and the topic.
  • marcinzm 7y ago
    >It would be different if DNT was enabled by default (I assume), but all browser makers dropped the ball here years ago. Browser makers did the logical decision as they have no control over websites adhering to DNT. If they made it default, every site would promptly ignore it as it'd impact their business too much to follow it. On the other hand, if they made it opt-in then sites might follow it for the minority of users who used DHT. In the end, it was a bad idea as it had no teeth at all to force adherence on websites.
• throwaway5752 7y ago
  Between some recent behavior like this, some recent hires, some questionable issue triage judgement, and product quality issues.. as a paying customer I am beginning to question what's up at Gitlab.
• jefurii 7y ago
  IIRC sourcehut/srht uses either JavaScript at all or very minimal non-third-party JS. Sourcehut came to my attention due to similar concerns with GitHub. Didn't take GitLab long to go from alternative to this.
• whalesalad 7y ago
  Gitlab is so incredibly reactionary. Competitor does something, let’s blog about how we do it too. We roll out new changes we’ve identified as being vital to our growth moving forward and users complain: okay nevermind let’s undo that. All this herky jerky stuff is mind blowing. They have a product people seem to like a lot but I don’t think they have the right core values and beliefs to sustain it long term. If they did, this would have been executed much better and there wouldn’t be this knee-jerk reaction to random gripes on the internet. Chasing shiny objects and the noisiest users is gonna get ya killed.
  • emilycook 7y ago
    (GitLab employee however these are my personal views) I agree that our blog posts about competitors aren't great (and thankfully have been happening less), but for this issue I'm glad to see that the backlash has been taken seriously because I had my own concerns. It'd be much more worrying if this went forward despite all of the imo justified backlash.
  • vpEfljFL 7y ago
    > They have a product people seem to like a lot but I don’t think they have the right core values and beliefs to sustain it long term. Sorry, but we can't expect it from "for profit" company especially backed by venture with the exit goal on ipo.
• phreack 7y ago
  So Gitlab basically became huge from nothing simply by strictly adhering to 'Github but better'. Now it's time for something else to do the same and pick up the ones who'll leave because of these policies with 'Gitlab but respects you'
• tombert 7y ago
  It's disappointing that Gitlab seems to be embracing the dark side; I've been recommending people use Gitlab if they're uneasy about Microsoft's purchase, but now it's giving me pause. I suppose I could run me own Gitlab CE, and maybe I'll have to. That or I finally have an excuse to build a competitor :)
• 0xffff2 7y ago
  I just deleted my Gitlab account. I'll be self-hosting personal projects from now on. It's clear that as an individual user of a third-party service you have virtually no control. No matter who you choose, the odds are that the owners of the service will eventually succumb to the siren song of VC money and sell their users' souls as a result.
• sysashi 7y ago
  What is this censorship by marking this entry as 'dupe' and hiding it from front page? Also, I guess it was a mistake to add middle-finger emoji to gitlab's interface. It looks hilarious seeing all those fingers!
• seabird 7y ago
  Somebody at GitLab thought it was a bright idea to add telemetry to their cloud AND self-hosted enterprise versions. Needless to say, it's not about to go over well. I currently use GitLab where I work; we chose it because our data is sensitive and a cloud service was not an option. This telemetry means that I won't be updating until this blows over. Frankly, whoever thought this was a good idea is a moron that doesn't seem to understand that users like my company chose GitLab because we didn't want this shit.
  • chris11 7y ago
    Fortunately they've updated the announcement and are holding back on the telemetry updates. But yeah, DNT is not an acceptable option for privacy. `In order to service the needs of GitLab.com and GitLab Self-Managed users who do not want to be tracked, both GitLab.com and GitLab Self-Managed will honor the Do Not Track (DNT) mechanism in web browsers` Hopefully the update includes a promise to enable deployments without telemetry code. https://gitlab.com/gitlab-org/gitaly/issues/2113 https://gitlab.com/gitlab-org/gitaly/issues/2113 https://about.gitlab.com/blog/2019/10/10/update-free-software-and-telemetry/ https://about.gitlab.com/blog/2019/10/10/update-free-softwar...
    • vpEfljFL 7y ago
      Just to point out if you care about privacy it's not recommended to turn on this feature becase close to none services support it and it's awesome fingerprinting feature for your browser as well. There is no way for Safari users to opt-out from this because Apple has decided to ditch "Do Not Track" because of privacy concerns.
      • GrayShade 7y ago
        I keep it enabled for sites that do respect it, like firefox.com and friends. By removing support from Safari, Apple took this choice away from their users, but I suppose that's not something surprising.
  • caseyf7 7y ago
    Engineers tried to resist, CFO insisted... https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#note_203849107 https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#no...
• emilycook 7y ago
  Work at GitLab, we've halted any movement on adding telemetry and are reconsidering our approach. More info is on this issue: https://gitlab.com/gitlab-org/growth/product/issues/164 https://gitlab.com/gitlab-org/growth/product/issues/164
  • bpchaps 7y ago
    Has anyone at gitlab told you to post here? The level of defensiveness reminds me a lot of the creepy Amazon fulfilment center twitter accounts. Edit: Why the downvotes? It's a serious question.
    • RussianCow 7y ago
      Their job title according to their profile is "Senior Community Advocate", so I would say that it's part of their job to post here.
      • bpchaps 7y ago
        Ah. Is that any different from a "Fulfillment Center Ambassador"?
        • xapata 7y ago
          Yes. BTW, not everyone knows what "FC" is an abbreviation for.
        • emilycook 7y ago
          I don't know what that means, but this is the handbook page on my position: https://about.gitlab.com/handbook/marketing/community-relations/community-advocacy/ https://about.gitlab.com/handbook/marketing/community-relati... although I've been needing to update it a bit. My job is to basically relay feedback to the rest of the company, and relay any information back to you all that might be relevant. We don't wanna be out-of-touch with what people are really saying about us, and we wanna make sure you're input is received, so that's basically why my team exists.
• kissgyorgy 7y ago
  Adding telemetry is the worst decision they made in years, and it was really sneaky (without previous notice). However if they reconsider and don't do this, it shows they care about customers. Would be nice.
• parliament32 7y ago
  After Github started being kinda gross, we were trying to decide between switching to Gitlab hosted or going self-hosted. Self-hosted was a pain but turns out it was a good choice. I'm sad to see Gitlab going down downhill like their predecessors. Is it really that hard to provide a no-bullshit hosted Git?
  • angry_octet 7y ago
    VCs, like drug cartels, are not satisfied with standard returns. There has to be new ideas for revenue growth and poisoning the ecosystem with advertising surveillance tooling is standard. For pseudo open source, code maturity and diverse contributors means a loss of control, so it always about adding code and making it more spaghetti.
  • edjrage 7y ago
    > Github started being kinda gross Mind elaborating?
• rz2k 7y ago
  According to my, possibly incorrect, take on the situation this does not really make that much sense. As I understand it, like GitHub, GitLab offers relatively permissive free plans to individuals and projects in their early stages. Both also offer pathways to graduate to commercial plans that are also enterprise friendly. It sounds like GitLab planned telemetry for the enterprise-managed plans (not the individual-managed plans). If GitLab was seen as an alternative to Microsoft-owned GitHub, the plans for telemetry undermined this reason for developers to start their projects with GitLab instead of GitHub and advocate its use to managers, investors, and legal departments. If that is the situation, where does SourceHut stand? The site makes little sense to me. The URL is sourcehut.org, but there is no statement about it being a non-profit, or any discussion about a board that manages it. There is a pricing page, but no contact us page. I don't know where it is based, and I can't find a reference on Crunchbase to get any idea of who owns the company. If it is a competitor to GitLab, maybe it is a competitor in the space for individual developers, but there wasn't a significant problem for individual developers when it comes to GitLab (or Github). If the problem with GitLab's announcement was that it made the upgrade path less enterprise friendly, how is SourceHub an improvement if by all appearances it is incompatible with any sane enterprise.
  • Sir_Cmpwn 7y ago
    I don't have a reply for most of your comment, but with respect to this part: >If that is the situation, where does SourceHut stand? The site makes little sense to me. The URL is sourcehut.org, but there is no statement about it being a non-profit, or any discussion about a board that manages it. There is a pricing page, but no contact us page. I don't know where it is based, and I can't find a reference on Crunchbase to get any idea of who owns the company. I own SourceHut as a sole proprietor, you can reach me at sir@cmpwn.com with private questions or ~sircmpwn/public-inbox@lists.sr.ht with public questions. Archives here: https://lists.sr.ht/~sircmpwn/public-inbox https://lists.sr.ht/~sircmpwn/public-inbox The business is operated transparently, here's the latest quarterly financial report: https://sourcehut.org/blog/2019-10-21-sourcehut-q3-2019-financial-report/ https://sourcehut.org/blog/2019-10-21-sourcehut-q3-2019-fina...
    • 7y ago
• scottfr 7y ago
  I am a bit surprised at the extreme negativity here. Obviously, this was mismanaged on many fronts [1], however the idea of tracking product usage in order to improve the product is generally a good thing, not a bad thing. Hacker News likes to complain about how bad the Gitlab UI is compared to Github, or how slow things are on Gitlab, or how they are doing too many things and need to focus their product better. Well, knowing how their users are using the product is one key part to improving all these things and delivering a better product. As a paid user of the Gitlab.com product, I am fine having them carry out analytics on user behavior like my own. That said, I do use an ad blocker and if they use 3rd party trackers I'll definitely be blocking those trackers. [1] E.g. the use of third parties for the telemetry. They should definitely be using in house systems for something like this not 3rd parties in order to protect their user data. Also, they should not be rolling this out to self-hosted versions.
  • 0xffff2 7y ago
    >Obviously, this was mismanaged on many fronts [1], however the idea of tracking product usage in order to improve the product is generally a good thing, not a bad thing. Disagree. The kind of client-side hyper granular tracking being discussed here is not a good thing. It encourages micro optimization for metrics over maintaining a good big-picture architecture. I've seen no evidence whatsoever that software is any better now than it was in the days when applications were off-line only.
• dang 7y ago
  This thread follows on yesterday's: https://news.ycombinator.com/item?id=21337594 https://news.ycombinator.com/item?id=21337594
• whalesalad 7y ago
  Absolutely hilarious. The folks running this ship (the company, not this endeavor) need to pause and reflect on the way they’re going about it. You’ve got a good product and great engagement. These decisions shouldn’t be so hard. Methinks this is due to their tendency to be overly transparent and design-by-committee oriented. Ya need a leader who has values and a vision for the future. If you need data, collect data. Stop walking on eggshells with your users. If they don’t like it let them leave and go elsewhere. The people complaining are likely the minority anyway.
• jagged-chisel 7y ago
  Based on a comment on the other thread, the CFO insisted on this originally. I'd love to hear specifically from the executive team about the CFO's instructions, and this 'rethinking.'
• dajohnson89 7y ago
  Sorry if this is an ignorant question, but: Why is the term "telemetry" used, instead of "logs" these days. Is there a substantial difference?
  • colechristensen 7y ago
    "telemetry" has been used for quite a while for information sent home. Usually a bit less log-like and is used for more metrics and status sorts of things. Logs are telemetry when they're sent to third party consumers who don't ordinarily have access to your systems. Telemetry is literally just remote metrics. Logs comes from ships throwing a piece of wood attached to a knotted rope over the stern and writing down the results in a log book to record speed at intervals as a part of normal navigation. Telemetry makes more sense :)
• deaps 7y ago
  We were talking for a while at work of going to gitlab (mainly my idea after using self-hosted for my own side projects) - but after this, there isn't a chance I'd be the one recommending it. In fact, I'd strongly recommend against it.
• altfredd 7y ago
  I don't like the stated justifications for enforcing telemetry — even if it is genuine, it is basically self-deception. In my experience, access to analytics is a quality of life improvement for programmer, that does not actually result in better products. Having a thousand times more crash-reports wont's cause your employees to grow extra hands and brain-cells to act on all of them. Having a great insight in user behavior does not automatically translate in great managerial decisions. Personally I would love Gitlab to stop overusing Javascript and fix performance of their backend instead of trying to conceal issues by refusing to show big files and abusing lazy-loading. But judging by their recent actions, they are more likely to copy more anti-features from Github than work on actual hard problems.
• layoutIfNeeded 7y ago
  * for now Privacy conscious orgs should work on migrating off GitLab.
• throwaway5752 7y ago
  Honestly, if you gave me a thoughtfully worded rationale (improving product and support, all data anonymized, etc) and defaulted it on, I probably wouldn't have given it a 2nd thought. The way this was presented created a lot of the problems. Some people would be upset regardless, and you need an opt-out for commercial customers. There are cases where collection is a nonstarter for security and compliance reasons. Some people are upset on philosphical grounds, and for those using Gitlab for free, I think you are perfectly within your limits to tell them to pound sand (or host it on their own/fork).
• SergeAx 7y ago
  Modern problems require modern solutions. The moment I see telemetry URLs in my browser - I will add it to uBlock Origin filters and submit a pull request into EasyList PrivacyList. Boom, like that.
• chris_wot 7y ago
  I’m actually curious how the Gnome project will react to this.
• wtfisthis1 7y ago
  well then you're a fucking loser
• jiveturkey 7y ago
  This is on .com only (for now). I'm at a loss as to why they'd need 3rd party telemetry for this. It's a service that they host. They have the data directly. It's not something that runs in the cloud (ie, on someone else's server) where they don't have first party access to the underlying data. Even if they want to visualize or analyze the data with someone else's tools that don't have import functionality, they can just "project" the data there without the user (client) being involved at all. The only reason they'd need to do this is for EE deployment where they don't in fact have the direct data. But certainly that's such a small part of their business. And, can't they just use what they know from .com usage data?
• ajnin 7y ago
  One of the very first comments below the original announcement post was someone wondering about the RGPD implications of that change, and mentioning that locking features behind a mandatory opt-in to tracking might be illegal. That comment is now gone. I wonder why.
• AcerbicZero 7y ago
  I'm re-thinking putting up with Gitlabs shit CI/CD system personally.
• ljm 7y ago
  This is the same Gitlab that recently banned politics at work and said they’d take anybody’s money, right? Gitlab is not an underdog, stop fighting for them.
• miki123211 7y ago
  I think the main problem with Git Lab and similar services is Git's inability to store anything other than code. If issues, wikis etc. would be stored in a Git repo itself, with the services potentially offering conveniences like web/email access etc. switching would be trivial. Git hosters would then need to be very, very careful and extremely competitive, as moving somewhere else would be a matter of minutes. There are some effords on this front[1], but I don't really know if anything will come of it. [1] https://github.com/sit-fyi/sit https://github.com/sit-fyi/sit
• reilly3000 7y ago
  I'm a data guy, I'm all for data gathering when there is a business case, permission, disclosure, and strong PII protection. However this is just silly. GitLab, on the doorstep of GitHub actions rolling out globally, shooting their leg off by forcing a 3rd party script into a business system. The thing that is utter shit is that they could really achieve any reasonable analytics needed from their server logs on their hosted systems. Pendo is the same as Heap analytics in that it logs EVERYTHING the user does, including things like scroll depth, time on page, form element selects, even clicks on non-clickable elements. You could just ask me how to make the UX better, GitLab; there is no need to do indiscriminate bulk collection. Or here's a novel idea: maybe actually give the users who choose to give you their behavior some kind of reward. A pro feature for free, some build runner priority, or even just a icon that glimmers with some gratitude. And an incognito switch for times when I don't want be seen. And a 3rd party? Its not that hard to put a pixel on a page and stand up an endpoint. What's to stop that 3rd party from injecting a keylogger and start harvesting secrets? Trust? If I were owning analytics at GitLab, I would: 1. Develop a way to get cleaned up server access logs in front of the UX team. This should get 85% of the work done. 2. Provide a 1st party controlled, open source client analytics tool that users can inspect. 3. Make it optional, off by default, and most importantly, fully accessible to the user. When its active it should provide a visual indication. Give opted in users a reward for participating. Give them the ability to see the data that has been gathered on them. Personally, I could find that log of my own activities quite useful if it were shared with me. 4. Prove the value of client side-tracking and share the wins with all stakeholders. Like, build a step in issue triage to gather metrics and share the results on the ticket to inform the decision making process. If the data doesn't does add double digit value to the company, kill the whole thing off. This was a brutal blunder for a company that's on Series E, and shows that leadership is not in touch with their customers. More actual face time with developers by leadership could have stopped this from happening.
  • donmcronald 7y ago
    We all have these analytics companies ranking our credit scores, social interactions, education levels, etc.. Just think of the data you could harvest from something like GitLab. The average developer does X merge requests per week. The average developer closes X bugs per week. The average developer makes X commits per week. What's your Pendo Developer Score?
• hn_throwaway_99 7y ago
  Decided to post a top-level comment because I think it's very important that Gitlab do a "root cause analysis" of why they made such a poor decision. Just saying "we're holding off for now" is not going to convince me that you guys have not lost your compass. For reference, there was a very telling comment by user jahlove about how Gitlab could be so out of touch (https://news.ycombinator.com/item?id=21349591 https://news.ycombinator.com/item?id=21349591): -------- > But someone up the chain of command thought we could get away with it That person is Paul Machle (CFO): "I don’t understand. This should not be an opt in or an opt out. It is a condition of using our product. There is an acceptance of terms and the use of this data should be included in that." [1] [1]https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#note_203849107 https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#no... -------- That GitLab comment thread is very telling. Basically, here is what happened: 1. It's clear engineers had concerns about the feature, wanting it to at least have an opt-in. 2. But then the CFO, who clearly does not anticipate the backlash this will cause, basically just gives an "tough shit" response. 3. What's scariest IMO, though, is that the Scott Williamson, VP of Product, then replies "@cciresi if we follow Paul's guidance and just make this part of our terms and conditions, are we covered legally?" I've seen this at many organizations in the past. It's generally called the HiPPO problem - the Highest Paid Person's Opinion. The CFO wanted this done (obviously for financial reasons, he's the CFO after all), but the VP of Product, who should be more "in the weeds" in terms of having the pulse of the customer, instead deferred to the CFO and tried to appease his desire. Gitlab, I think your organization is off track. You need to make a broader statement that shows you have a real understanding of the problem than just "Oops".
  • semiotagonal 7y ago
    It might have been better to simply reference the discussion without singling out the person involved. At the end of the day it was an organizational decision. It's to GitLab's credit that there's enough transparency to even see this; I don't think it's too cool to turn that into a finger-pointing tool. As a developer, we don't do this with bugs. Perhaps bad business decisions are not any different. (For the record: I don't know this person, I am not this person, I'm pretty sure I don't know anyone at GitLab at all.)
• crb002 7y ago
  ICE ops says what?
• chrisweekly 7y ago
  What a cluster. On a related but brighter note, third-party cookies are finally getting some long-overdue meaningful attention: https://blog.chromium.org/2019/10/developers-get-ready-for-new.html?m=1 https://blog.chromium.org/2019/10/developers-get-ready-for-n...
• deleted 7y ago
  [deleted]
• deleted 7y ago
  [deleted]
• thayne 7y ago
  I've seen a lot of negativity about gitlab, and personally, I think that any third party telemetry should be opt-in, not opt-out. However, I do think they should be applauded on what they did right. First, they have been very transparent about the whole thing. While many companies would try to hide it in the ToS in vague legalese, Gitlab published a blog post explaining what they were doing and why, and opened public issues about the topic. Secondly, they listened to feedback from customers (and the internet at large). Even though the backlash shouldn't have been surprising, at least GitLab responded quickly by pulling back when it was clear the community disapproved. And finally, even though it was supposed to be opt-out instead of opt-in, at least they clearly communicated _how_ to opt-out. Which is more than can be said of most companies, which make opting out as difficult as possible. Yes, GitLab messed up. But at least they acknowledge that, and were transparent about the whole thing.
  • Rapzid 7y ago
    The backlash hasn't finished. The negativity in on here is part of the backlash.
• CM30 7y ago
  Probably a silly question, but isn't at least the community edition of GitLab open source? So wouldn't it be a possibility to just fork the project outright and remove the telemetry from there? Or is there something in GitLab's licensing that makes that impossible despite it being 'open core' or whatever it is?
• colejohnson66 7y ago
  Can we fix the title? The use of scare quotes on “rethinking” specifically.
  • dang 7y ago
    Those are not scare quotes, they're standard quotes. They add the information that Gitlab used that word. Scare quotes are used to express irony or skepticism when you're not quoting someone.
  • acollins1331 7y ago
    I didn't even make a throwaway account to call you a shill, it's that obvious.
    • dang 7y ago
      This breaks more than one of the site guidelines, but especially the one against insinuating astroturfing or shillage without evidence. That's a serious violation. Please read https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and don't do that when posting here. Edit: we had to ask you not to break the site guidelines just a few days ago as well. Doing that repeatedly will eventually get your account banned, so please don't do that.
    • colejohnson66 7y ago
      I am not a shill. Why I even need to say that, I don’t know... I will admit I have not yet read the webpage, but the use of scare quotes is wrong. Regardless of your views, HN says not to editorialize headlines. Putting quotes around “rethinking” is showing a bias against the webpage. That’s editorializing.
    • rishav_sharan 7y ago
      Why the personal attack? This is not Reddit.
  • hnarn 7y ago
    Scare quotes? They literally say: >We're going to process the feedback and rethink our approach.
• teekert 7y ago
  I think Ubuntu does this well. If you listen to Canonical employees explaining their telemetry, it's a one time transmission, it's opt-out, you can inspect the json file that is being sent (inside the installer) and it will help them focus on what issues to address first. I don't see anything wrong with it.
• TipiKoivisto 7y ago
  Is there an explanation WHY ja WHAT information is collected?
• gexla 7y ago
  Thanks Gitlab for providing the opportunity to create a statement on something which will likely become increasingly common. That they would consider doing this will force me to re-evaluate my decision to ever use Gitlab or recommend it to others.
• sytse 7y ago
  Further follow-up https://news.ycombinator.com/item?id=21390563 https://news.ycombinator.com/item?id=21390563