8 ms·

The reaction to this whole saga has been insane. Chill out people. They fucked up, users gave feedback, they listened. This isn't some corporate conspiracy, s

by tyre 7y ago

The reaction to this whole saga has been insane. Chill out people. They fucked up, users gave feedback, they listened. This isn't some corporate conspiracy, some grand ethical dilemma with an evil company on one side and some white knight hackers on the other. Let's imagine for a second that they are people trying to do the right thing, with years of history doing the best they can. They wanted to measure usage to make their product better. People seem to disagree, which, okay, but the outrage here is everything wrong with the internet.

Operyl 7y ago
I think what sparked a bit more outcry in this matter is the way the CFO responded to discussion and early warnings way before it was finalized. EDIT: https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#note_203849107 https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#no...
- cwkoss 7y ago
  Bit surprised that Paul Machle is still employed as CFO.
  - mbesto 7y ago
    Lesson learned here - the CFO is not and should not be responsible for a company's tracking policies and communication thereof.
    - bigiain 7y ago
      Sadly, that "F" means they pretty much have veto power over anything anybody (with the possible exception of the CTO and the board) wants to do.
      - maximente 7y ago
        sadly? that the board failed to stop this (or was bypassed) is telling, but this doesn't seem like a failure of the corporate governance model or anything. money is basically essential to a corporation; engineering staff shouldn't be on the level of C suite, despite what many here would have you believe
        semiotagonal 7y ago
        Although I think the person is getting too much grief for this, I have to say that if a CFO is allowed to make decisions in an area where he lacks understanding, simply because his title starts with a "C", that counts as a failure of the governance model.
        bigiain 7y ago
        "Sadly" because in this instance, it appears there's a CFO in power who's championing selling user's privacy out. Not a comment of whether or not a CFO in general has more influence than engineering (or other) staff, but that an ethically challenged CFO is potentially a toxic influence to a company culture and direction.
      - mbesto 7y ago
        Uh, that's not how it works. Legitimate veto power is usually based on a board and/or shares of the company. Not to mention most CFOs are appointed positions in startups, because they are usually not roles filled in the early days of a tech startups life (as opposed to CEOs and CTOs). Note - it is worth saying, CFOs are, generally speaking consider extremely important positions for many companies, even more-so than the CEO. But this isn't because they make policy decisions or conduct external communications, but rather because they control the lifeblood of any company - the money.
        bigiain 7y ago
        "Oh, you're wanting to implement more 'privacy' for our users? Well it turns out that we've just done a reorg, and your whole department has no budget for the rest of the year." As you say, whoever controls the money flow, ultimately controls the people, and can shut down any activity they desire... Sure it's not "legitimate veto power", but ultimately it is the same thing.
        mbesto 7y ago
        > whoever controls the money flow, ultimately controls the people, and can shut down any activity they desire I never said this...
        bigiain 7y ago
        Sorry. I was paraphrasing your " ... but rather because they control the lifeblood of any company - the money." rather than directly quoting you there. I think my point stands.
      - deleted 7y ago
        [deleted]
xiphias2 7y ago
They wanted to violate my rights given by Article 7.2 of the General Data Protection Regulation (GDPR), this is clearly making the product worse. What's great with GitLab compared to other companies is that they are doing things in the open, while another company would just violate my rights without me knowing it. If you go through the comments, multiple (toxic) people in GitLab doesn't care about user rights, just want to push the change as soon as possible (just like in any other company that I have been working in). It's also clear that you get VP/Director/Staff engineer by just pushing through other people (sadly I have seen the same thing happening other times as well).
- SamReidHughes 7y ago
  You can opt out by not using it, right? They'd be supposed to drop EU users, under some interpretation of the law. But even if they didn't, then as an EU user, you'd still be able to protect your own rights by ceasing use of their services.
  - bigiain 7y ago
    GDPR pretty much says "you can't do that". The advice I have bookmarked (which I'll admit is not a legal opinion or the source legislation) says: ‘specific website content’ means that you should not make ‘general access’ subject to conditions requiring users to accept non-essential cookies – you can only limit certain content if the user does not consent; and the term ‘legitimate purpose’ refers to facilitating the provision of an information society service – ie, a service the user explicitly requests. This does not include third parties such as analytics services or online advertising. As I read/understand things, unless the service you're providing is "being tracked by advertisers or analytics", you cannot block ac cess to users based on then not consenting to being tracked for advertising/analytics. Pretty sure "They'd be supposed to drop EU users, under some interpretation of the law." is correct there, and that if Gitlab wants to have tracking consent as a mandatory requirement for using their source control service, they'd need to stop selling it in EU completely.
    - SamReidHughes 7y ago
hn_throwaway_99 7y ago
> The reaction to this whole saga has been insane. Chill out people. I very much disagree. I think the outcry was warranted, and right now I see GitLab doing the right thing (and, obviously, the outcry was a huge reason for that). Changing plans in the harsh light of public condemnation isn't easy, and for that I very much commend GitLab. As someone who was very much against the previously announced change, though ( https://news.ycombinator.com/item?id=21350146 https://news.ycombinator.com/item?id=21350146 ), I'm glad the community feedback was so strong.
- prophesi 7y ago
  Yeah, if the outcry continued even after their rollback & apology, _then_ it would be unwarranted. But everyone's happy now (well, arguably GitLab may not be, but they should surely be able to work out a solution with the community on how to collect telemetrics in a privacy-conscious way). I'm also glad the feedback was so strong, as the ad-tech industry has spent the past 15 years numbing the general populace to unwarranted (and often unnecessary) telemetrics. It's understandable that GitLab had no ill-intentions. But how can one know whether third-parties share such sentiments?
  - flukus 7y ago
    > Yeah, if the outcry continued even after their rollback & apology, _then_ it would be unwarranted. The outcry may stop but the trust is now gone and will take years to rebuild. Next time I'm considering/recommending on-premise git hosting I won't be recommending gitlab. I'm also considering moving my personal repos that I pay for. Generally I only interact through the CLI and don't think about the web interface much, but apparently when I go there I'm sharing info with whatever the hell gravatar is.
    - hunter2_ 7y ago
      While I haven't used it myself, I think gravitar is an avatar that gravitates toward you, as implemented by you putting an image on their server, and countless other websites include it from that server when an identifier (probably email address) match exists between the two accounts. So in other words, gravitar knows a bit about your usage of countless websites that each volunteered your usage pattern to it. Since evidently you are seeing a connection between your machine and gravatar, they get page-load granularity. If this description is incorrect, which it very well might be since I know nothing about the service beyond what I inferred by its name, please do correct me.
deleted 7y ago
[deleted]
elliekelly 7y ago
> Let's imagine for a second that they are people trying to do the right thing, with years of history doing the best they can. When I first saw they had their compliance policy repos set to public so anyone could view internal discussions around changes the lawyer in me just about fell off my chair. That is an almost unbelievable level of transparency. It's difficult for me to assume anything but the best intentions when GitLab has gone out of their way to let people see how the sausage is made.
acrispino 7y ago
How do we know that they would have changed their plans without the outrage?
- EpicEng 7y ago
  They wouldn't have. many devs were against it internally, but they went forward anyway with the opt-out scheme. Why would they go through all that, announce the feature, and then just decide to cancel it?
deleted 7y ago
[deleted]
Accacin 7y ago
> Let's imagine for a second that they are people trying to do the right thing, with years of history doing the best they can. How could a company like this ever think that opt-out is appropriate? It seems like all their engineers knew this was a bad idea and everyone else seemed to think it was okay! The problem for me was how a company like this couldn't see that this would happen and went along with it, I held Gitlab to a high standard and honestly I've lost a lot of trust with them. I'm thankful for the outrage, and whilst I will never condemn personal attacks, I feel discussing the matter on places like HN was appropriate.
- EpicEng 7y ago
  Not to mention the fact that the CFO didn't want to even allow opt-out under any circumstances.
EpicEng 7y ago
Their CFO showed that he has little regard for the privacy of their users. I highly doubt that has changed. Many devs and compliance folk were on the right side of this in the MR and feature threads, but they were overruled. I highly doubt the CFO has changed his viewpoint, and he's still in power over there. They only backtracked after the "insane" reaction. They anticipated some amount of pushback, but obviously hoped it would be smaller and they could move forward.
- SamReidHughes 7y ago
  Privacy? Their users are companies building software. The CFO is right -- they can agree or disagree to the terms of use and choose whether or not to use the new software.
  - EpicEng 7y ago
    >Privacy? Their users are companies building software Not sure I follow your logic there. First of all, he's not right. As stated by the compliance officer in that thread, his plan would have violated the GDPR. It also would have violated existing contracts with enterprise customers. Secondly, it's a scummy thing to do. just because you have the right to do something doesn't make it the right thing to do.
    - SamReidHughes 7y ago
      I'm not talking about existing contracts or the law in some far-off land, and neither are you. You deserve nothing. You aren't entitled to Gitlab releasing software the way you'd like them to. Maybe your brain tells you otherwise. Instead, just don't use their software. For example, I wish Windows 10 didn't have telemetry. But it does, so I don't use Windows 10. The world doesn't owe you a free Git issue tracker.
      - EpicEng 7y ago
        Oh, so you're not talking about the two ways in which he is objectively wrong in arguing to implement this feature, only that a vendor has the right to add user hostile terms to their ToS. Ok, well you've convinced me! Honestly, who here is arguing that they can't implement some form of this? No one. Exactly no one. We don't like what it, and we're the consumer! It's not entitlement to pushback when a vendor changes their terms in a way you don't like. I have no idea what point you're trying to make here.
stefan_ 7y ago
Uhm, they sent a mail saying "we're locking all access to your project data until you accept our new ToS, or fuck off". It doesn't take a genius to realize the mistake here.
overgard 7y ago
If there hadn't been an outcry gitlab wouldn't have changed their trajectory. Seems like it worked.
bogomipz 7y ago
>"The reaction to this whole saga has been insane. Chill out people." No, it hasn't unless a civil discussion in an area where people have strong opinions is somehow your definition of "insane." >"People seem to disagree, which, okay, but the outrage here is everything wrong with the internet." There is no "outrage" here just lots of concern if not some well-placed bewilderment at a particular brusque comment made by their CFO on the issue[1] The great irony is that you have dismissed and self-proclaimed that an entire civilized and adult discussion as "outrage culture" and "everything wrong with the internet." [1] https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#note_203849107 https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#no...

by tyre 7y ago

Operyl 7y ago

I think what sparked a bit more outcry in this matter is the way the CFO responded to discussion and early warnings way before it was finalized. EDIT: https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#note_203849107 https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#no...

cwkoss 7y ago
Bit surprised that Paul Machle is still employed as CFO.
- mbesto 7y ago
  Lesson learned here - the CFO is not and should not be responsible for a company's tracking policies and communication thereof.
  - bigiain 7y ago
    Sadly, that "F" means they pretty much have veto power over anything anybody (with the possible exception of the CTO and the board) wants to do.
    - maximente 7y ago
      sadly? that the board failed to stop this (or was bypassed) is telling, but this doesn't seem like a failure of the corporate governance model or anything. money is basically essential to a corporation; engineering staff shouldn't be on the level of C suite, despite what many here would have you believe
      - semiotagonal 7y ago
        Although I think the person is getting too much grief for this, I have to say that if a CFO is allowed to make decisions in an area where he lacks understanding, simply because his title starts with a "C", that counts as a failure of the governance model.
      - bigiain 7y ago
        "Sadly" because in this instance, it appears there's a CFO in power who's championing selling user's privacy out. Not a comment of whether or not a CFO in general has more influence than engineering (or other) staff, but that an ethically challenged CFO is potentially a toxic influence to a company culture and direction.
    - mbesto 7y ago
      Uh, that's not how it works. Legitimate veto power is usually based on a board and/or shares of the company. Not to mention most CFOs are appointed positions in startups, because they are usually not roles filled in the early days of a tech startups life (as opposed to CEOs and CTOs). Note - it is worth saying, CFOs are, generally speaking consider extremely important positions for many companies, even more-so than the CEO. But this isn't because they make policy decisions or conduct external communications, but rather because they control the lifeblood of any company - the money.
      - bigiain 7y ago
        "Oh, you're wanting to implement more 'privacy' for our users? Well it turns out that we've just done a reorg, and your whole department has no budget for the rest of the year." As you say, whoever controls the money flow, ultimately controls the people, and can shut down any activity they desire... Sure it's not "legitimate veto power", but ultimately it is the same thing.
        mbesto 7y ago
        > whoever controls the money flow, ultimately controls the people, and can shut down any activity they desire I never said this...
        bigiain 7y ago
        Sorry. I was paraphrasing your " ... but rather because they control the lifeblood of any company - the money." rather than directly quoting you there. I think my point stands.
    - deleted 7y ago
      [deleted]

xiphias2 7y ago

They wanted to violate my rights given by Article 7.2 of the General Data Protection Regulation (GDPR), this is clearly making the product worse. What's great with GitLab compared to other companies is that they are doing things in the open, while another company would just violate my rights without me knowing it. If you go through the comments, multiple (toxic) people in GitLab doesn't care about user rights, just want to push the change as soon as possible (just like in any other company that I have been working in). It's also clear that you get VP/Director/Staff engineer by just pushing through other people (sadly I have seen the same thing happening other times as well).

SamReidHughes 7y ago
You can opt out by not using it, right? They'd be supposed to drop EU users, under some interpretation of the law. But even if they didn't, then as an EU user, you'd still be able to protect your own rights by ceasing use of their services.
- bigiain 7y ago
  GDPR pretty much says "you can't do that". The advice I have bookmarked (which I'll admit is not a legal opinion or the source legislation) says: ‘specific website content’ means that you should not make ‘general access’ subject to conditions requiring users to accept non-essential cookies – you can only limit certain content if the user does not consent; and the term ‘legitimate purpose’ refers to facilitating the provision of an information society service – ie, a service the user explicitly requests. This does not include third parties such as analytics services or online advertising. As I read/understand things, unless the service you're providing is "being tracked by advertisers or analytics", you cannot block ac cess to users based on then not consenting to being tracked for advertising/analytics. Pretty sure "They'd be supposed to drop EU users, under some interpretation of the law." is correct there, and that if Gitlab wants to have tracking consent as a mandatory requirement for using their source control service, they'd need to stop selling it in EU completely.
  - SamReidHughes 7y ago

hn_throwaway_99 7y ago

> The reaction to this whole saga has been insane. Chill out people. I very much disagree. I think the outcry was warranted, and right now I see GitLab doing the right thing (and, obviously, the outcry was a huge reason for that). Changing plans in the harsh light of public condemnation isn't easy, and for that I very much commend GitLab. As someone who was very much against the previously announced change, though ( https://news.ycombinator.com/item?id=21350146 https://news.ycombinator.com/item?id=21350146 ), I'm glad the community feedback was so strong.

prophesi 7y ago
Yeah, if the outcry continued even after their rollback & apology, _then_ it would be unwarranted. But everyone's happy now (well, arguably GitLab may not be, but they should surely be able to work out a solution with the community on how to collect telemetrics in a privacy-conscious way). I'm also glad the feedback was so strong, as the ad-tech industry has spent the past 15 years numbing the general populace to unwarranted (and often unnecessary) telemetrics. It's understandable that GitLab had no ill-intentions. But how can one know whether third-parties share such sentiments?
- flukus 7y ago
  > Yeah, if the outcry continued even after their rollback & apology, _then_ it would be unwarranted. The outcry may stop but the trust is now gone and will take years to rebuild. Next time I'm considering/recommending on-premise git hosting I won't be recommending gitlab. I'm also considering moving my personal repos that I pay for. Generally I only interact through the CLI and don't think about the web interface much, but apparently when I go there I'm sharing info with whatever the hell gravatar is.
  - hunter2_ 7y ago
    While I haven't used it myself, I think gravitar is an avatar that gravitates toward you, as implemented by you putting an image on their server, and countless other websites include it from that server when an identifier (probably email address) match exists between the two accounts. So in other words, gravitar knows a bit about your usage of countless websites that each volunteered your usage pattern to it. Since evidently you are seeing a connection between your machine and gravatar, they get page-load granularity. If this description is incorrect, which it very well might be since I know nothing about the service beyond what I inferred by its name, please do correct me.

deleted 7y ago

[deleted]

elliekelly 7y ago

> Let's imagine for a second that they are people trying to do the right thing, with years of history doing the best they can. When I first saw they had their compliance policy repos set to public so anyone could view internal discussions around changes the lawyer in me just about fell off my chair. That is an almost unbelievable level of transparency. It's difficult for me to assume anything but the best intentions when GitLab has gone out of their way to let people see how the sausage is made.

acrispino 7y ago

How do we know that they would have changed their plans without the outrage?

EpicEng 7y ago
They wouldn't have. many devs were against it internally, but they went forward anyway with the opt-out scheme. Why would they go through all that, announce the feature, and then just decide to cancel it?

deleted 7y ago

[deleted]

Accacin 7y ago

> Let's imagine for a second that they are people trying to do the right thing, with years of history doing the best they can. How could a company like this ever think that opt-out is appropriate? It seems like all their engineers knew this was a bad idea and everyone else seemed to think it was okay! The problem for me was how a company like this couldn't see that this would happen and went along with it, I held Gitlab to a high standard and honestly I've lost a lot of trust with them. I'm thankful for the outrage, and whilst I will never condemn personal attacks, I feel discussing the matter on places like HN was appropriate.

EpicEng 7y ago
Not to mention the fact that the CFO didn't want to even allow opt-out under any circumstances.

EpicEng 7y ago

Their CFO showed that he has little regard for the privacy of their users. I highly doubt that has changed. Many devs and compliance folk were on the right side of this in the MR and feature threads, but they were overruled. I highly doubt the CFO has changed his viewpoint, and he's still in power over there. They only backtracked after the "insane" reaction. They anticipated some amount of pushback, but obviously hoped it would be smaller and they could move forward.

SamReidHughes 7y ago
Privacy? Their users are companies building software. The CFO is right -- they can agree or disagree to the terms of use and choose whether or not to use the new software.
- EpicEng 7y ago
  >Privacy? Their users are companies building software Not sure I follow your logic there. First of all, he's not right. As stated by the compliance officer in that thread, his plan would have violated the GDPR. It also would have violated existing contracts with enterprise customers. Secondly, it's a scummy thing to do. just because you have the right to do something doesn't make it the right thing to do.
  - SamReidHughes 7y ago
    I'm not talking about existing contracts or the law in some far-off land, and neither are you. You deserve nothing. You aren't entitled to Gitlab releasing software the way you'd like them to. Maybe your brain tells you otherwise. Instead, just don't use their software. For example, I wish Windows 10 didn't have telemetry. But it does, so I don't use Windows 10. The world doesn't owe you a free Git issue tracker.
    - EpicEng 7y ago
      Oh, so you're not talking about the two ways in which he is objectively wrong in arguing to implement this feature, only that a vendor has the right to add user hostile terms to their ToS. Ok, well you've convinced me! Honestly, who here is arguing that they can't implement some form of this? No one. Exactly no one. We don't like what it, and we're the consumer! It's not entitlement to pushback when a vendor changes their terms in a way you don't like. I have no idea what point you're trying to make here.

stefan_ 7y ago

Uhm, they sent a mail saying "we're locking all access to your project data until you accept our new ToS, or fuck off". It doesn't take a genius to realize the mistake here.

overgard 7y ago

If there hadn't been an outcry gitlab wouldn't have changed their trajectory. Seems like it worked.

bogomipz 7y ago

>"The reaction to this whole saga has been insane. Chill out people." No, it hasn't unless a civil discussion in an area where people have strong opinions is somehow your definition of "insane." >"People seem to disagree, which, okay, but the outrage here is everything wrong with the internet." There is no "outrage" here just lots of concern if not some well-placed bewilderment at a particular brusque comment made by their CFO on the issue[1] The great irony is that you have dismissed and self-proclaimed that an entire civilized and adult discussion as "outrage culture" and "everything wrong with the internet." [1] https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#note_203849107 https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#no...