4 ms·

I got Gitlab's email and immediately knew people would be freaking out about it. The fallacy of transparency: The more transparent you are, the more people thi

I got Gitlab's email and immediately knew people would be freaking out about it. The fallacy of transparency: The more transparent you are, the more people think you're up to some shady shit. It's crazy.

JohnFen 7y ago
That's not the fallacy of transparency. The real fallacy is when companies think that doing shady shit is OK as long as they're transparent about it.
- scrollaway 7y ago
  Someone's going to have to explain to me how Gitlab is doing something shady with this stuff. Unless I'm misreading all this, it all looks like very standard telemetry, the same kind Github is doing.
  - gbear605 7y ago
    Part of the issue is that proprietary software would be running from a company that advertises itself as being oriented around free software. In addition, it would apply to the enterprise deployments, which is bad because enterprises can’t allow telemetry for regulatory and security reasons.
    - scrollaway 7y ago
      > Part of the issue is that proprietary software would be running from a company that advertises itself as being oriented around free software. They're also running on Google's cloud, which is mostly proprietary software. And I can tell you right now they use the most-definitely-closed-source Salesforce for a lot of stuff. Do you think there's actually a significant amount of people who care about the license type of the internal tools of the companies they use?
      - gbear605 7y ago
        None of that is frontend though, which is an important distinction.
        scrollaway 7y ago
        Can you explain to me why that's a distinction? If anything we're talking about frontend JS code that can be blocked by most adblockers/tracker blockers and thus will never touch your data, rather than the uncircumventable "your data is hosted on Google servers". And the latter does raise alarm bells for a tiny minority, but why would frontend be worse in that aspect?
        gbear605 7y ago
        With frontend code, it’s code running on your machine that you can’t personally audit written by a company you don’t personally trust. For some situations (enterprises) and people (FOSS enthusiasts, paranoiacs), that’s not at all okay.
  - JohnFen 7y ago
    I'm not claiming that Gitlab is doing anything shady with the data, I'm making a general comment about the notion of "transparency" as a panacea. I do object to what Gitlab proposed, though, because I object to all telemetry that I don't specifically opt in to.
whatshisface 7y ago
Do you think that if they had just put the tracker in nobody would have noticed? I think it would go silent for a month, and then become the subject of a top-of-HN blog post about how some enterprise security guy discovered it. Gitlab would write a blog post about how sorry they were, nobody would believe them, and there would be no way to un-do the breach of trust. By allowing everyone on HN to tell at them not to implement the change before doing it, they have made themselves able to avoid the catastrophe by cancelling the plan. Although the best thing Gitlab could have done for their public image as a trustworthy service provider would be to never have even let on that they would consider such a thing, this is the next best option, because whoever wanted to do this now has lost some internal political credibility.
- scrollaway 7y ago
  I'm sure people would have noticed. Hell, some may have noticed immediately. But it would have been a non-story unless everyone got an email and had to google around for what's going on and figure out whether they need to be outraged.
authoritarian 7y ago
If you're transparent about doing some shady shit, you're still doing some shady shit
adventured 7y ago
I think it's a lot more simple than that and has everything to do with the privacy environment today. People in tech really, really, really dislike it when the products/services they use attempt to track them (generally speaking). There is very little trust these days on such matters, the default setting for tech people is to not trust companies that go anywhere near privacy violations, surveillance, tracking, et al. rather than giving the benefit of the doubt. Gitlab should have seen this coming a million kilometers away.
- scrollaway 7y ago
  > People in tech really, really, really dislike it when the products/services they use attempt to track them (generally speaking). This isn't even sort of generally speaking true. Nearly EVERYONE on HN is aware to some extent how incredibly massively they're tracked by their ISP, by Google and Facebook, by their phone, by their phone's manufacturer, by their operating system, by the security cameras in all the shops they visit, by proxy through all their friends who aren't as privacy-conscious as they may be, etc. I see very few people "hating" this. And I say it as someone who does hate it. Most people here are aware of it, and they all have the "tingly feeling", but most actually do choose to actively ignore it. "I don't have to deal with the idea that my phone is tracking me until there's public outrage abou tit" sort of thing. And I'm not stubborn enough to put "gitlab wants to know how their product is being used" and "samsung wants to know what I'm watching and when" in the same bucket. And given how much of an improvement gitlab is over the status quo, I also know not to make enemies of my closest allies.
eitland 7y ago
Have you considered that often the reason why we don't complain about the worse alternatives are that we already are avoiding them/mitigating them? Not always, but often.
indigochill 7y ago
Well, when you're transparent about adding features that users don't want, I don't think it comes as a surprise that users express they don't want those features. Granted, Gitlab wants telemetry in order to understand how Gitlab is being used. I'm sympathetic to their goal. But I'm also sympathetic to a sort of "NIMBY" response from users even if overall telemetry might improve the ecosystem for everyone. It's a sort of "tragedy of the commons" situation.
orclev 7y ago
There's also elements of selection bias as well. If you're highly transparent it's likely that people who value that will be drawn to your product, so when you subsequently take steps to reduce that transparency somewhat (such as roping in a third party from an industry known to engage in shady things), and make it mandatory for users in the most intrusive way possible, it's likely to garner a bigger backlash than for a less transparent product because your user base cares about that sort of thing more.
deleted 7y ago
[deleted]

JohnFen 7y ago

That's not the fallacy of transparency. The real fallacy is when companies think that doing shady shit is OK as long as they're transparent about it.

scrollaway 7y ago
Someone's going to have to explain to me how Gitlab is doing something shady with this stuff. Unless I'm misreading all this, it all looks like very standard telemetry, the same kind Github is doing.
- gbear605 7y ago
  Part of the issue is that proprietary software would be running from a company that advertises itself as being oriented around free software. In addition, it would apply to the enterprise deployments, which is bad because enterprises can’t allow telemetry for regulatory and security reasons.
  - scrollaway 7y ago
    > Part of the issue is that proprietary software would be running from a company that advertises itself as being oriented around free software. They're also running on Google's cloud, which is mostly proprietary software. And I can tell you right now they use the most-definitely-closed-source Salesforce for a lot of stuff. Do you think there's actually a significant amount of people who care about the license type of the internal tools of the companies they use?
    - gbear605 7y ago
      None of that is frontend though, which is an important distinction.
      - scrollaway 7y ago
        Can you explain to me why that's a distinction? If anything we're talking about frontend JS code that can be blocked by most adblockers/tracker blockers and thus will never touch your data, rather than the uncircumventable "your data is hosted on Google servers". And the latter does raise alarm bells for a tiny minority, but why would frontend be worse in that aspect?
        gbear605 7y ago
        With frontend code, it’s code running on your machine that you can’t personally audit written by a company you don’t personally trust. For some situations (enterprises) and people (FOSS enthusiasts, paranoiacs), that’s not at all okay.
- JohnFen 7y ago
  I'm not claiming that Gitlab is doing anything shady with the data, I'm making a general comment about the notion of "transparency" as a panacea. I do object to what Gitlab proposed, though, because I object to all telemetry that I don't specifically opt in to.

whatshisface 7y ago

Do you think that if they had just put the tracker in nobody would have noticed? I think it would go silent for a month, and then become the subject of a top-of-HN blog post about how some enterprise security guy discovered it. Gitlab would write a blog post about how sorry they were, nobody would believe them, and there would be no way to un-do the breach of trust. By allowing everyone on HN to tell at them not to implement the change before doing it, they have made themselves able to avoid the catastrophe by cancelling the plan. Although the best thing Gitlab could have done for their public image as a trustworthy service provider would be to never have even let on that they would consider such a thing, this is the next best option, because whoever wanted to do this now has lost some internal political credibility.

scrollaway 7y ago
I'm sure people would have noticed. Hell, some may have noticed immediately. But it would have been a non-story unless everyone got an email and had to google around for what's going on and figure out whether they need to be outraged.

authoritarian 7y ago

If you're transparent about doing some shady shit, you're still doing some shady shit

adventured 7y ago

I think it's a lot more simple than that and has everything to do with the privacy environment today. People in tech really, really, really dislike it when the products/services they use attempt to track them (generally speaking). There is very little trust these days on such matters, the default setting for tech people is to not trust companies that go anywhere near privacy violations, surveillance, tracking, et al. rather than giving the benefit of the doubt. Gitlab should have seen this coming a million kilometers away.

scrollaway 7y ago
> People in tech really, really, really dislike it when the products/services they use attempt to track them (generally speaking). This isn't even sort of generally speaking true. Nearly EVERYONE on HN is aware to some extent how incredibly massively they're tracked by their ISP, by Google and Facebook, by their phone, by their phone's manufacturer, by their operating system, by the security cameras in all the shops they visit, by proxy through all their friends who aren't as privacy-conscious as they may be, etc. I see very few people "hating" this. And I say it as someone who does hate it. Most people here are aware of it, and they all have the "tingly feeling", but most actually do choose to actively ignore it. "I don't have to deal with the idea that my phone is tracking me until there's public outrage abou tit" sort of thing. And I'm not stubborn enough to put "gitlab wants to know how their product is being used" and "samsung wants to know what I'm watching and when" in the same bucket. And given how much of an improvement gitlab is over the status quo, I also know not to make enemies of my closest allies.

eitland 7y ago

Have you considered that often the reason why we don't complain about the worse alternatives are that we already are avoiding them/mitigating them? Not always, but often.

indigochill 7y ago

Well, when you're transparent about adding features that users don't want, I don't think it comes as a surprise that users express they don't want those features. Granted, Gitlab wants telemetry in order to understand how Gitlab is being used. I'm sympathetic to their goal. But I'm also sympathetic to a sort of "NIMBY" response from users even if overall telemetry might improve the ecosystem for everyone. It's a sort of "tragedy of the commons" situation.

orclev 7y ago

There's also elements of selection bias as well. If you're highly transparent it's likely that people who value that will be drawn to your product, so when you subsequently take steps to reduce that transparency somewhat (such as roping in a third party from an industry known to engage in shady things), and make it mandatory for users in the most intrusive way possible, it's likely to garner a bigger backlash than for a less transparent product because your user base cares about that sort of thing more.

deleted 7y ago

[deleted]