4 ms·

I trust Cloudflare a whole lot more than Gitlab. CF makes all the right noises around privacy for their 1.1.1.1 service, for example. Gitlab is still the team

I trust Cloudflare a whole lot more than Gitlab. CF makes all the right noises around privacy for their 1.1.1.1 service, for example. Gitlab is still the team that didn't notice that three of their three independent backup mechanisms had not been working for weeks to months. And while wholly cloning Github is legal, I started having serious doubts about their ethical instincts when they repeatedly tried to incite people against Github for cloning minor features. Beyond that: it depends. I tend to believe large vendors are worse for privacy of generic consumers, because they have the scale where it pays off to sell data or do "big data" analysis. They are better for individual high-value targets because they have more. to lose, and less to win, relative to whatever they could expect by screwing you over. Protection against rogue employees is also something that happens in larger teams, if at all.

eganist 7y ago
> Gitlab is still the team that didn't notice that three of their three independent backup mechanisms had not been working for weeks to months. So, this is a really good point. Someone made the smart decision within Gitlab to outsource some of the harder problems to an outside party with serious experience on the topics rather than trying to script their way out of the challenge themselves. > Protection against rogue employees is also something that happens in larger teams, if at all. ref: amazon w/r/t capital one for a good example of this exact failure mode. (Can't tell if we're in agreement; your statement is a bit ambiguous, but given "if at all," I'm assuming we're on the same page)
- seanhunter 7y ago
  My understanding is that the Capital One breach didn't involve any secret information known only to Amazon employees. CapOne had a misconfigured firewall and allowed public internet traffic to servers which were not hardened and got compromised. The person behind the breach happens to have previously worked at Amazon, but it wasn't a rogue Amazon employee breaching an AWS customer.
  - eganist 7y ago
    Seems you're right - https://www.wired.com/story/capital-one-paige-thompson-case-hacking-spree/ https://www.wired.com/story/capital-one-paige-thompson-case-... > Thompson's prior role at the company didn't lend her any insider access in this case. Thanks for the fact check!
throwGuardian 7y ago
> Gitlab is still the team that ... I just don't get why the internet neither forgets nor forgives. A startup in it's early days makes mistakes, the only real mistake Gitlab made was be fully transparent about theirs. You vouch for CF (and no beef against them), but you know nothing of their internal privacy or reliability pitfalls. That warm fuzzy feeling you have about CF is a result of their carefully groomed PR coupled with 0% opacity on internals. Again, not saying CF has any issues, but if they did, you wouldn't know
- ignoramous 7y ago
  > I just don't get why the internet neither forgets nor forgives. Trust takes a lifetime to build and a moment to collapse.
  - tlb 7y ago
    Humans in their first few years of life are totally untrustworthy, yet most adults can be trusted. That falsifies your theory of trust. Do you want modify it to accommodate young people and/or young companies? EDIT: toned down
    - falcor84 7y ago
      How does that falsify that theory of trust? I would take an extra set of pants for a long trip with a 5 year old even if they hadn't pooped their pants for a full year. It takes a long while before I let go of that preparedness.
      - StavrosK 7y ago
        The GP is saying that people (/companies?) change.
    - ignoramous 7y ago
      Leaving aside the false equivalence of comparing a toddler with a company ran by adults with fully developed faculties of reason, judgement, choice, will etc; pooping your own pants is your own business. When it crosses the line that it affects others intentionally, the culture of the company is laid bare. There's so much emphasis from YC themselves to get the initial years right in terms of people and culture, but this was a genuine brain-fart and that such things do lose you customers for a lifetime, sometimes. Humans are fickle. But that's just like you know my opinion.
tedunangst 7y ago
What makes the gitlab database loss worse than cloudbleed? (Both occurred within the same month.)

eganist 7y ago

> Gitlab is still the team that didn't notice that three of their three independent backup mechanisms had not been working for weeks to months. So, this is a really good point. Someone made the smart decision within Gitlab to outsource some of the harder problems to an outside party with serious experience on the topics rather than trying to script their way out of the challenge themselves. > Protection against rogue employees is also something that happens in larger teams, if at all. ref: amazon w/r/t capital one for a good example of this exact failure mode. (Can't tell if we're in agreement; your statement is a bit ambiguous, but given "if at all," I'm assuming we're on the same page)

seanhunter 7y ago
My understanding is that the Capital One breach didn't involve any secret information known only to Amazon employees. CapOne had a misconfigured firewall and allowed public internet traffic to servers which were not hardened and got compromised. The person behind the breach happens to have previously worked at Amazon, but it wasn't a rogue Amazon employee breaching an AWS customer.
- eganist 7y ago
  Seems you're right - https://www.wired.com/story/capital-one-paige-thompson-case-hacking-spree/ https://www.wired.com/story/capital-one-paige-thompson-case-... > Thompson's prior role at the company didn't lend her any insider access in this case. Thanks for the fact check!

throwGuardian 7y ago

> Gitlab is still the team that ... I just don't get why the internet neither forgets nor forgives. A startup in it's early days makes mistakes, the only real mistake Gitlab made was be fully transparent about theirs. You vouch for CF (and no beef against them), but you know nothing of their internal privacy or reliability pitfalls. That warm fuzzy feeling you have about CF is a result of their carefully groomed PR coupled with 0% opacity on internals. Again, not saying CF has any issues, but if they did, you wouldn't know

ignoramous 7y ago
> I just don't get why the internet neither forgets nor forgives. Trust takes a lifetime to build and a moment to collapse.
- tlb 7y ago
  Humans in their first few years of life are totally untrustworthy, yet most adults can be trusted. That falsifies your theory of trust. Do you want modify it to accommodate young people and/or young companies? EDIT: toned down
  - falcor84 7y ago
    How does that falsify that theory of trust? I would take an extra set of pants for a long trip with a 5 year old even if they hadn't pooped their pants for a full year. It takes a long while before I let go of that preparedness.
    - StavrosK 7y ago
      The GP is saying that people (/companies?) change.
  - ignoramous 7y ago
    Leaving aside the false equivalence of comparing a toddler with a company ran by adults with fully developed faculties of reason, judgement, choice, will etc; pooping your own pants is your own business. When it crosses the line that it affects others intentionally, the culture of the company is laid bare. There's so much emphasis from YC themselves to get the initial years right in terms of people and culture, but this was a genuine brain-fart and that such things do lose you customers for a lifetime, sometimes. Humans are fickle. But that's just like you know my opinion.

tedunangst 7y ago

What makes the gitlab database loss worse than cloudbleed? (Both occurred within the same month.)