5 ms·

We've seen two episodes of companies who enjoy the goodwill of the enthusiast/advocate sector committing obvious foot-gun maneuvers in as many weeks. First it

by bhauer 7y ago

We've seen two episodes of companies who enjoy the goodwill of the enthusiast/advocate sector committing obvious foot-gun maneuvers in as many weeks. First it was GitLab, and now Ubiquiti. Both should have known better than to hoist telemetry on self-hosted software. Doing so betrays a willful ignorance or disdain (or both) for the very reasons these enthusiasts self-host. The good news is that in both cases, the community has been clear in its reprimand, and the companies have reversed course (or promised to do so, in the case of Ubiquiti). I'd like to see more companies realize this is an opportunity rather than a threat: an opportunity to create products and services that deeply respect privacy and market this advantage over the competition.

Arcanum-XIII 7y ago
They're not reversing course since it's not an opt-in, but still an opt-out. I don't want to inspect every hidden option on my hardware to be sure that nothing is spying on me. For me it's still not solve here. I'm sad, because now I have to find another hardware provider that I can trust.
- bhauer 7y ago
  I hear you, and I agree I'd prefer all telemetry to be strictly opt-in. I'd be comfortable with software prompting me to make that decision at installation time to have a chance at me answering affirmatively (I'll virtually never opt in after installation). But I consider an opt-out a workable option in this case, as long as they realize this mistake should not be repeated, which remains to be seen. Is there any alternative that provides the elegance and affordability of UniFi SDN?
- thelittleone 7y ago
  Thank you. This is an important distinction to make that I wasn’t aware of. Maybe they will end up making it opt in. In the mean time, would an open source tool to automate ubiquiti opt outs be useful?
ocdtrekkie 7y ago
Indeed. It's especially odd when companies seem to fail to realize their entire market is comprised of people leaving larger, more established companies largely because of things like this.
ohazi 7y ago
GitLab's CFO was kind enough to leave public evidence of his incompetence: "I don’t understand. This should not be an opt in or an opt out. It is a condition of using our product. There is an acceptance of terms and the use of this data should be included in that." [1] In the previous thread people were referring to the HiPPO problem (Highest Paid Person's Opinion). I'm willing to bet that it's the same story at Ubiquity. But despite occasional backpedaling, there are rarely any real consequences for the irredeemably stupid managers who push for crap like this. Unfortunately, that's probably the only way to make it stop. In my opinion, if the outcry is bad enough for a company to backpedal on a decision like this, then it's already bad enough that they should fire the manager responsible for making the decision in the first place. These aren't line employees. The company doesn't pay them more than everybody else for fun -- they're paid to understand the business well enough to know better. People in these positions tend to be natural risk takers. If there are never real consequences, they're going to continue to bet anything they can get their hands on for a shot at personal gain, and the company and their customers are going to foot the bill. [1] https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#note_203849107 https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#no...
- dylz 7y ago
  In [1] it's even worse that you have Gitlab's "VP of Legal" and "Director of Global Risk and Compliance" chasing after the CFO's comments telling him that's illegal. That seems kind of messed up to an outsider, like the CFO is completely disregarding and ignoring critical staff that know more than he does in specific regulated fields.
  - nkrisc 7y ago
    > In [1] it's even worse that you have Gitlab's "VP of Legal" and "Director of Global Risk and Compliance" chasing after the CFO's comments telling him that's illegal. That doesn't shock me though, and I would say is expected. After all, it's their job to know what's legal and watch over the decisions the company makes.
- ploxiln 7y ago
  Don't penalize GitLab too harshly for having public issues and discussion. The obvious fix will be to just not have all this public, which is what all other companies of non-trivial size do. I think the CFO's comment was illuminating, but not really worse than I would expect from any misc C-level in any industry.
Someone1234 7y ago
It is worth saying that half of GitLab's "crime" was the telemetry, the other half was the completely unprofessional way they rolled it out. They essentially disabled people's paid for hosted GitLab accounts, until they agreed to the collection. See [0] from GitLab: > Starting with GitLab 12.4, existing customers who use our proprietary products (that is, GitLab.com and the Enterprise Edition of our self-managed offerings) may notice additional Javascript snippets that will interact with GitLab and/or third-party SaaS telemetry service (such as Pendo). [...] as we roll out this update you will be prompted to accept our new Terms of Service. Until the new Terms are accepted access to the web interface and API will be blocked. So, for users who have integrations with our API this will cause a brief pause in service via our API until the terms have been accepted by signing in to the web interface. At least Ubiquiti had the basic courtesy of not breaking people's paid service/devices to roll out their questionable telemetry. Even if it should be opt in, not opt out. [0] https://gitlab.com/gitlab-org/gitlab/issues/34833 https://gitlab.com/gitlab-org/gitlab/issues/34833
stefan_ 7y ago
I mean, the complaints are a bit rich coming from the very people that dump countless of third-party "crash collection" SaaS and other marketing SDKs into their apps or have marketing insert whatever script tags they want into websites. Where is the personal responsibility gone to? Chances are, if you are reading this, you are working at a company that does this very thing! For much more meaningless things than enterprise hardware with custom OS.
- jgtrosh 7y ago
  Crash collection is common, so personal responsibility should be to just accept opt-out dumps in a security device? That's a weird argument. This is a pretty clear cut case as the users have made clear; it's good that they make it so clear because it might change the mentality of businesses in which it's still perceived as perfectly fine practice.
jrockway 7y ago
The complaint seems unfair. Every piece of commercial software I've ever used has crash reporting. You can't develop software without knowing how it breaks. Even Debian has popcon.

by bhauer 7y ago

Arcanum-XIII 7y ago

They're not reversing course since it's not an opt-in, but still an opt-out. I don't want to inspect every hidden option on my hardware to be sure that nothing is spying on me. For me it's still not solve here. I'm sad, because now I have to find another hardware provider that I can trust.

bhauer 7y ago
I hear you, and I agree I'd prefer all telemetry to be strictly opt-in. I'd be comfortable with software prompting me to make that decision at installation time to have a chance at me answering affirmatively (I'll virtually never opt in after installation). But I consider an opt-out a workable option in this case, as long as they realize this mistake should not be repeated, which remains to be seen. Is there any alternative that provides the elegance and affordability of UniFi SDN?
thelittleone 7y ago
Thank you. This is an important distinction to make that I wasn’t aware of. Maybe they will end up making it opt in. In the mean time, would an open source tool to automate ubiquiti opt outs be useful?

ocdtrekkie 7y ago

Indeed. It's especially odd when companies seem to fail to realize their entire market is comprised of people leaving larger, more established companies largely because of things like this.

ohazi 7y ago

GitLab's CFO was kind enough to leave public evidence of his incompetence: "I don’t understand. This should not be an opt in or an opt out. It is a condition of using our product. There is an acceptance of terms and the use of this data should be included in that." [1] In the previous thread people were referring to the HiPPO problem (Highest Paid Person's Opinion). I'm willing to bet that it's the same story at Ubiquity. But despite occasional backpedaling, there are rarely any real consequences for the irredeemably stupid managers who push for crap like this. Unfortunately, that's probably the only way to make it stop. In my opinion, if the outcry is bad enough for a company to backpedal on a decision like this, then it's already bad enough that they should fire the manager responsible for making the decision in the first place. These aren't line employees. The company doesn't pay them more than everybody else for fun -- they're paid to understand the business well enough to know better. People in these positions tend to be natural risk takers. If there are never real consequences, they're going to continue to bet anything they can get their hands on for a shot at personal gain, and the company and their customers are going to foot the bill. [1] https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#note_203849107 https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#no...

dylz 7y ago
In [1] it's even worse that you have Gitlab's "VP of Legal" and "Director of Global Risk and Compliance" chasing after the CFO's comments telling him that's illegal. That seems kind of messed up to an outsider, like the CFO is completely disregarding and ignoring critical staff that know more than he does in specific regulated fields.
- nkrisc 7y ago
  > In [1] it's even worse that you have Gitlab's "VP of Legal" and "Director of Global Risk and Compliance" chasing after the CFO's comments telling him that's illegal. That doesn't shock me though, and I would say is expected. After all, it's their job to know what's legal and watch over the decisions the company makes.
ploxiln 7y ago
Don't penalize GitLab too harshly for having public issues and discussion. The obvious fix will be to just not have all this public, which is what all other companies of non-trivial size do. I think the CFO's comment was illuminating, but not really worse than I would expect from any misc C-level in any industry.

Someone1234 7y ago

It is worth saying that half of GitLab's "crime" was the telemetry, the other half was the completely unprofessional way they rolled it out. They essentially disabled people's paid for hosted GitLab accounts, until they agreed to the collection. See [0] from GitLab: > Starting with GitLab 12.4, existing customers who use our proprietary products (that is, GitLab.com and the Enterprise Edition of our self-managed offerings) may notice additional Javascript snippets that will interact with GitLab and/or third-party SaaS telemetry service (such as Pendo). [...] as we roll out this update you will be prompted to accept our new Terms of Service. Until the new Terms are accepted access to the web interface and API will be blocked. So, for users who have integrations with our API this will cause a brief pause in service via our API until the terms have been accepted by signing in to the web interface. At least Ubiquiti had the basic courtesy of not breaking people's paid service/devices to roll out their questionable telemetry. Even if it should be opt in, not opt out. [0] https://gitlab.com/gitlab-org/gitlab/issues/34833 https://gitlab.com/gitlab-org/gitlab/issues/34833

stefan_ 7y ago

I mean, the complaints are a bit rich coming from the very people that dump countless of third-party "crash collection" SaaS and other marketing SDKs into their apps or have marketing insert whatever script tags they want into websites. Where is the personal responsibility gone to? Chances are, if you are reading this, you are working at a company that does this very thing! For much more meaningless things than enterprise hardware with custom OS.

jgtrosh 7y ago
Crash collection is common, so personal responsibility should be to just accept opt-out dumps in a security device? That's a weird argument. This is a pretty clear cut case as the users have made clear; it's good that they make it so clear because it might change the mentality of businesses in which it's still perceived as perfectly fine practice.

jrockway 7y ago

The complaint seems unfair. Every piece of commercial software I've ever used has crash reporting. You can't develop software without knowing how it breaks. Even Debian has popcon.