5 ms·

> There is no way that I would host a solution that includes third-party scripts. At least for now, it appears that the self-hosted versions of GitLab (both CE

> There is no way that I would host a solution that includes third-party scripts. At least for now, it appears that the self-hosted versions of GitLab (both CE and EE) will not be getting telemetry scripts. This is only for gitlab.com (again, for now). See the table on their ticket[1] for the issue 1: https://gitlab.com/gitlab-org/growth/product/issues/164 https://gitlab.com/gitlab-org/growth/product/issues/164

jka 7y ago
From that link, it doesn't exactly sound like they've ruled out the possibility of adding this tracking to EE too however - and reading between the lines, it sounds like they'd prefer telemetry to be enabled by default if & when that does happen? We are not adding Pendo or Snowplow JS snippets to self-hosted versions at this time. We are carefully considering the appropriate opt-out functionality for telemetry that will work best for our customers, and we will clearly communicate to those customers when any change is made.
- jhasse 7y ago
  > opt-in by default So ... opt-out?
  - jka 7y ago
    Thanks :) Comment edited to (hopefully) clarify the language.
- Animats 7y ago
  Right. That basically says "We're going to back off until people stop paying attention, then ram in the anal probe".
- jahlove 7y ago
  it seems pretty clear they intend to add it to EE eventually. Every single time they talk about it, they say, "we're not considering changing EE at this time".
JohnFen 7y ago
> At least for now, it appears that the self-hosted versions of GitLab (both CE and EE) will not be getting telemetry scripts. Yes, for now. But I think everyone can realistically expect that it will be included there eventually. Those of us who find this unacceptable should probably start planning their mitigation strategy now.
- jrowley 7y ago
  The entire nature of self hosted is that it is for companies or people who want more control. It’s Seems ill advised and unlikely for gitlab to force telemetry on those users.
  - JohnFen 7y ago
    > It’s Seems ill advised and unlikely for gitlab to force telemetry on those users. I would have thought that the way they rolled this out was obviously so ill-advised that they wouldn't have been likely to do it, but they did. Also, they initially were going to include the self-hosted installations in this as well, but backed off due to the outcry. So even though it's also obviously a bad idea, they were provably likely to do it, because that was their explicit plan.
  - x0x0 7y ago
    Also, it's a red flag in any security review. Every time we answer security questionnaires this comes up. I'm stunned they would consider adding this to hosted software.
- zaroth 7y ago
  Or just opt-out, if they ever add it, and if it is not opt-in at that time.
  - JohnFen 7y ago
    Yes, for those who really need to stay on Gitlab. Where my thinking is at right now, though, is that Gitlab has just tangibly demonstrated that they don't deserve a great deal of trust, and so I'm not inclined to trust any opt-in or opt-out choices. Even if they're effective at the time they are introduced (which I don't really doubt they would be), I am not comfortable in relying that they won't change the deal in the future.

jka 7y ago

From that link, it doesn't exactly sound like they've ruled out the possibility of adding this tracking to EE too however - and reading between the lines, it sounds like they'd prefer telemetry to be enabled by default if & when that does happen? We are not adding Pendo or Snowplow JS snippets to self-hosted versions at this time. We are carefully considering the appropriate opt-out functionality for telemetry that will work best for our customers, and we will clearly communicate to those customers when any change is made.

jhasse 7y ago
> opt-in by default So ... opt-out?
- jka 7y ago
  Thanks :) Comment edited to (hopefully) clarify the language.
Animats 7y ago
Right. That basically says "We're going to back off until people stop paying attention, then ram in the anal probe".
jahlove 7y ago
it seems pretty clear they intend to add it to EE eventually. Every single time they talk about it, they say, "we're not considering changing EE at this time".

JohnFen 7y ago

> At least for now, it appears that the self-hosted versions of GitLab (both CE and EE) will not be getting telemetry scripts. Yes, for now. But I think everyone can realistically expect that it will be included there eventually. Those of us who find this unacceptable should probably start planning their mitigation strategy now.

jrowley 7y ago
The entire nature of self hosted is that it is for companies or people who want more control. It’s Seems ill advised and unlikely for gitlab to force telemetry on those users.
- JohnFen 7y ago
  > It’s Seems ill advised and unlikely for gitlab to force telemetry on those users. I would have thought that the way they rolled this out was obviously so ill-advised that they wouldn't have been likely to do it, but they did. Also, they initially were going to include the self-hosted installations in this as well, but backed off due to the outcry. So even though it's also obviously a bad idea, they were provably likely to do it, because that was their explicit plan.
- x0x0 7y ago
  Also, it's a red flag in any security review. Every time we answer security questionnaires this comes up. I'm stunned they would consider adding this to hosted software.
zaroth 7y ago
Or just opt-out, if they ever add it, and if it is not opt-in at that time.
- JohnFen 7y ago
  Yes, for those who really need to stay on Gitlab. Where my thinking is at right now, though, is that Gitlab has just tangibly demonstrated that they don't deserve a great deal of trust, and so I'm not inclined to trust any opt-in or opt-out choices. Even if they're effective at the time they are introduced (which I don't really doubt they would be), I am not comfortable in relying that they won't change the deal in the future.