7 ms·

This is fantastic. Thank you, GitHub. I hope this is a good demonstration of a hands-off approach at Microsoft in regard to company culture. I realize you li

This is fantastic. Thank you, GitHub. I hope this is a good demonstration of a hands-off approach at Microsoft in regard to company culture. I realize you likely still collect some analytics for yourself and that this change does nothing to alleviate that. EG, first party javascript. But it's great that it's divorced from 3rd parties. Presumably Microsoft has access to those metrics, though? I wonder how deeply that gets parsed in conjunction with everything else they collect. If only you could export some of that culture back to your corporate overlord. I'd love if MS Teams stopped exploding it's RAM usage until it eventually has to be killed if it's unable to get an OK response from its analytics endpoint. And I'd love to turn off analytics in Windows altogether. Even getting to the minimal analytic configuration is an exercise in futility spread out across a million different settings, some of which decide to reset themselves in obfuscated ways sometimes. eg, some think updates reset them, either directly or by doing things like changing default programs to ones which require analytics (eg Office). Or a change to one setting requires additional changes elsewhere to be effective.

buckmar 6y ago
That's a good point. Microsoft has been much less heavy handed than I expected. But your point about how the data is used, I am very curious too. I wonder if they'd be willing to make the privacy policy readable?..
- einpoklum 6y ago
  Microsoft would like for you to adopt an image of GitHub as an upright corporate endeavor - but remember they blocks/censor developers from world states that the US doesn't like.
  - deleted 6y ago
    [deleted]
  - belval 6y ago
    Microsoft/GitHub as businesses incorporated in the United States are bound by the law of the United States. I am not sure of what you are insinuating here.
    - einpoklum 6y ago
      Oh, great, they have an excuse. Just like they have an excuse for allowing the NSA direct access to all of your data, right?
      - belval 6y ago
        Yes, I don't understand this weird movement where businesses are expected to go against the government. You disagree with your own government that's perfectly fine, and for the record I agree with you on the issues themselves, but if you want embargoes against Iran to be lifted or for the NSA to stop hoarding Americans' data you have to do the boring work of convincing the people to vote for people who share those ideas. Real change will not come from corporations, it simply cannot because their mission if profitability, they support movements if there is no financial risk to do so.
dessant 6y ago
GitHub still sends the same personal data to their own analytics endpoint, and the privacy policy which lists third-party data subprocessors [1] has not been updated. See my comment below for details: https://news.ycombinator.com/item?id=25458635 https://news.ycombinator.com/item?id=25458635 Tracking cookies have little value for GitHub when they can collect data about users that have already been authenticated, and they send the username and user ID as part of their tracking request. Inspect the request sent to collector.githubapp.com on every page load to see the type of personal data that is being collected on the client-side. We have no visibility into how they associate this data with analytics data collected on the server-side, and that's where an updated privacy policy would also help. [1] https://docs.github.com/en/free-pro-team@latest/github/site-policy/github-subprocessors-and-cookies https://docs.github.com/en/free-pro-team@latest/github/site-...
- irrational 6y ago
  What is the real value in a privacy policy? I assumed they were similar to EULAs - totally unenforceable. Are there actually any legal repercussions if they lie in their privacy policy? Or is it just ill will that might be accrued (and probably quickly forgotten) if they are found out to have violated their own privacy policy?
  - tsimionescu 6y ago
    GDPR should have given some legal teeth to privacy policies.
    - hetspookjee 6y ago
      I haven't seen a lot of repercussions, if any actually. I would've figured something big would've happened right now with the antics that are up, but here we are - necessary to download an _opt-out_ extension for Google Analytics. This couldn't be a more blatant disregard for the EU laws than I could imagine. And at the same time here in the Netherlands we have the party responsible for enforing laws handing out one, almost disproportionally large fine, to a small organisation each year. Like a 800k fine to a tennis unity because they were too aggressive in their data grievance, while all the big guys are still going at it and then some. Sorry for the rant but it's hard to stay optimistic, so seeing something like Github making a good move in the right direction, and seeing the post of plausible.io on the front page, this seems like a good day on the front of privacy.
an_opabinia 6y ago
If you don’t have to actually make money though, there isn’t really a point to the analytics third parties enable - eliminating bots and click fraud. Microsoft managers are incentivized to not identify bot or noise traffic, since their performance metrics do not separate those.
- 6510 6y ago
  It is harder than that. I would for example like to use google maps api - but I cant.
suyash 6y ago
Good job, can more companies follow the lead now? Btw when I see that banner - I always reject the option and still have not experienced any bad experience from website.
boogies 6y ago
> I hope this is a good demonstration of a hands-off approach at Microsoft in regard to company culture. I might 1‰ buy that if they restored the Widevine repos they snuck down for Google under cover of the controversy caused by complying with the MS-funded RIAA’s quasi-legal youtube-dl takedown request.
yuhong 6y ago
I think I mentioned in a previous thread that CompatTelRunner/Appraiser is so bad that even MS employees like Billy O"Neal complain about it because of the CPU and HDD/SSD time it consumes.

buckmar 6y ago

That's a good point. Microsoft has been much less heavy handed than I expected. But your point about how the data is used, I am very curious too. I wonder if they'd be willing to make the privacy policy readable?..

einpoklum 6y ago
Microsoft would like for you to adopt an image of GitHub as an upright corporate endeavor - but remember they blocks/censor developers from world states that the US doesn't like.
- deleted 6y ago
  [deleted]
- belval 6y ago
  Microsoft/GitHub as businesses incorporated in the United States are bound by the law of the United States. I am not sure of what you are insinuating here.
  - einpoklum 6y ago
    Oh, great, they have an excuse. Just like they have an excuse for allowing the NSA direct access to all of your data, right?
    - belval 6y ago
      Yes, I don't understand this weird movement where businesses are expected to go against the government. You disagree with your own government that's perfectly fine, and for the record I agree with you on the issues themselves, but if you want embargoes against Iran to be lifted or for the NSA to stop hoarding Americans' data you have to do the boring work of convincing the people to vote for people who share those ideas. Real change will not come from corporations, it simply cannot because their mission if profitability, they support movements if there is no financial risk to do so.

dessant 6y ago

GitHub still sends the same personal data to their own analytics endpoint, and the privacy policy which lists third-party data subprocessors [1] has not been updated. See my comment below for details: https://news.ycombinator.com/item?id=25458635 https://news.ycombinator.com/item?id=25458635 Tracking cookies have little value for GitHub when they can collect data about users that have already been authenticated, and they send the username and user ID as part of their tracking request. Inspect the request sent to collector.githubapp.com on every page load to see the type of personal data that is being collected on the client-side. We have no visibility into how they associate this data with analytics data collected on the server-side, and that's where an updated privacy policy would also help. [1] https://docs.github.com/en/free-pro-team@latest/github/site-policy/github-subprocessors-and-cookies https://docs.github.com/en/free-pro-team@latest/github/site-...

irrational 6y ago
What is the real value in a privacy policy? I assumed they were similar to EULAs - totally unenforceable. Are there actually any legal repercussions if they lie in their privacy policy? Or is it just ill will that might be accrued (and probably quickly forgotten) if they are found out to have violated their own privacy policy?
- tsimionescu 6y ago
  GDPR should have given some legal teeth to privacy policies.
  - hetspookjee 6y ago
    I haven't seen a lot of repercussions, if any actually. I would've figured something big would've happened right now with the antics that are up, but here we are - necessary to download an _opt-out_ extension for Google Analytics. This couldn't be a more blatant disregard for the EU laws than I could imagine. And at the same time here in the Netherlands we have the party responsible for enforing laws handing out one, almost disproportionally large fine, to a small organisation each year. Like a 800k fine to a tennis unity because they were too aggressive in their data grievance, while all the big guys are still going at it and then some. Sorry for the rant but it's hard to stay optimistic, so seeing something like Github making a good move in the right direction, and seeing the post of plausible.io on the front page, this seems like a good day on the front of privacy.

an_opabinia 6y ago

If you don’t have to actually make money though, there isn’t really a point to the analytics third parties enable - eliminating bots and click fraud. Microsoft managers are incentivized to not identify bot or noise traffic, since their performance metrics do not separate those.

6510 6y ago
It is harder than that. I would for example like to use google maps api - but I cant.

suyash 6y ago

Good job, can more companies follow the lead now? Btw when I see that banner - I always reject the option and still have not experienced any bad experience from website.

boogies 6y ago

> I hope this is a good demonstration of a hands-off approach at Microsoft in regard to company culture. I might 1‰ buy that if they restored the Widevine repos they snuck down for Google under cover of the controversy caused by complying with the MS-funded RIAA’s quasi-legal youtube-dl takedown request.

yuhong 6y ago

I think I mentioned in a previous thread that CompatTelRunner/Appraiser is so bad that even MS employees like Billy O"Neal complain about it because of the CPU and HDD/SSD time it consumes.