12 ms·

GitHub still sends the same personal data to their own analytics endpoint, and the privacy policy which lists third-party data subprocessors [1] has not been up

GitHub still sends the same personal data to their own analytics endpoint, and the privacy policy which lists third-party data subprocessors [1] has not been updated. See my comment below for details: https://news.ycombinator.com/item?id=25458635 https://news.ycombinator.com/item?id=25458635 Tracking cookies have little value for GitHub when they can collect data about users that have already been authenticated, and they send the username and user ID as part of their tracking request. Inspect the request sent to collector.githubapp.com on every page load to see the type of personal data that is being collected on the client-side. We have no visibility into how they associate this data with analytics data collected on the server-side, and that's where an updated privacy policy would also help. [1] https://docs.github.com/en/free-pro-team@latest/github/site-policy/github-subprocessors-and-cookies https://docs.github.com/en/free-pro-team@latest/github/site-...

irrational 6y ago
What is the real value in a privacy policy? I assumed they were similar to EULAs - totally unenforceable. Are there actually any legal repercussions if they lie in their privacy policy? Or is it just ill will that might be accrued (and probably quickly forgotten) if they are found out to have violated their own privacy policy?
- tsimionescu 6y ago
  GDPR should have given some legal teeth to privacy policies.
  - hetspookjee 6y ago
    I haven't seen a lot of repercussions, if any actually. I would've figured something big would've happened right now with the antics that are up, but here we are - necessary to download an _opt-out_ extension for Google Analytics. This couldn't be a more blatant disregard for the EU laws than I could imagine. And at the same time here in the Netherlands we have the party responsible for enforing laws handing out one, almost disproportionally large fine, to a small organisation each year. Like a 800k fine to a tennis unity because they were too aggressive in their data grievance, while all the big guys are still going at it and then some. Sorry for the rant but it's hard to stay optimistic, so seeing something like Github making a good move in the right direction, and seeing the post of plausible.io on the front page, this seems like a good day on the front of privacy.
- 1vuio0pswjnm7 6y ago
  Violation of privacy policies alone does not give rise to a cause of action. However such violations could be useful as evidence in the context of suing on some other basis. Of course, there is no satisfactory basis to sue tech companies for violations of privacy. That is why privacy is being decimated by tech companies. There are no adequate laws to protect it. Privacy policies seem to be an effective way to placate the public. Users seem to take tech companies on their word.
- mumblemumble 6y ago
  It sounds like you have misunderstood the purpose of a privacy policy. It is very rare that I encounter one that is designed to protect the user's privacy. Far more often, it's there to protect the company. "I have read and agree to the privacy policy," is a coded way of saying, "I have read and agree to waive my claims to privacy, as outlined in the privacy policy."
  - nobody9999 6y ago
    >Far more often, it's there to protect the company. That's pretty much true. And why shouldn't a group try to limit their liability? >"I have read and agree to the privacy policy," is a coded way of saying, "I have read and agree to waive my claims to privacy, as outlined in the privacy policy." That's often, but not always true. For example, here's a [sanitized] privacy policy I wrote for a website I set up for a specific (noncommercial) purpose: "[Site] Privacy Policy No personal information^ will be stored on the https://www.[site] https://www.[site] web server (except as specifically authorized), and every effort will be made to protect the integrity and privacy of such information. [Site], its management or assignees will never sell personal information collected on this site, nor will they use such information for purposes other than specifically related to the operation of the [Site] website and/or to facilitate the dissemination of information regarding [purpose of site] and other group activities related to [potential users] and other [user purpose] related group activities. Under no circumstances will street address or telephone number information be stored on the www.[site] by [Site], its management or assignees. [Site], its management and assignees will never, under any circumstances reveal email addresses, street addresses and/or telephone numbers to anyone without explicit authorization. From time to time, [site] may offer services to allow [potential users] to contact each other. For these services, [Site], its management and assignees makes no warrantee of fitness for any purpose, including maintaining the privacy of users' personal information. All personal information will be held in confidence and will only used for the purposes of the [potential users] [purpose of site] and official [membership organization] business. This business includes (but is not limited to) providing personal information for inclusion (by the [membership organization]) in a printed work to be published at a later date. If this published work is then used for illegal and/or nuisance purposes, [Site], its management and assignees disavow any responsibility or liability for the use of that information by third parties for any purpose. If a subscriber (limited to members of the [potential users]) chooses to share their personal information with other subscribers via any mechanism made available through the [Site] web site, mailing list or other conveyance provided by [Site], its management and assignees disavow any responsibility or liability for the use of that information by third parties for any purpose. Under no circumstances will [Site], its management or assignees be liable or otherwise legally responsible for the theft, misuse or other unauthorized use of personal information. Any person or entity registering on, providing contact information, or subscribing to the [Site] web site explicitly agrees to all the terms of this privacy policy. This policy applies to the www.[Site] web site and the [Purpose of site]@[Site] mailing list. If any portion of this policy is found, by any competent jurisdiction, to be invalid or unlawful, the remainder of this policy will continue to be in force. The terms of this policy may be modified at any time at the discretion of [Site]. It is the responsibility of the subscriber to review the terms of this policy on a regular basis. Current versions of this policy can be found at https://www.[site]/privacy.html https://www.[site]/privacy.html. ^Personal Information: Data such as street address, email address and telephone number which would enable direct contact with the subject of that information." It does two specific things: 1. Informs users how their PII will (and will not) be used; 2. Clarifies the liability of those who own/run the site. Unlike most "privacy" policies, there's nothing underhanded or privacy invading/data stealing involved. I wish more privacy policies were like that.
dessant 6y ago
A GitHub spokesperson has issued this statement [1] about a request to api.github.com: "That endpoint tracks aggregate performance metrics, and does not rely on cookies or other unique identifiers". GitHub is still sending our usernames and other unique IDs, our device data, and the pages we visit to the collector.githubapp.com endpoint. GitHub's claims about not tracking users are false, they do identify users in tracking requests. See this tracking URL, it's full of unique identifiers and personal data, and it is currently sent after every page load, without user consent: https://collector.githubapp.com/github/page_view?dimensions[page]=https://github.com/&dimensions[title] =GitHub&dimensions[referrer]=https://github.com/sessions/two-factor&dimensions[user_agent]=Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0&dimensions[screen_resolution]=1000x518&dimensions[pixel_ratio] =1&dimensions[browser_resolution]=1000x518&dimensions[tz_seconds]=0&dimensions[timestamp] =1608247177900&dimensions[referrer]=https://github.com/sessions/two-factor&dimensions[request_id]= 9CF8:4938:4516EA:5FD134:5FDBE77E&dimensions[visitor_id]=6475638196559144773& dimensions[region_edge]=fra&dimensions[region_render]=iad&&measures[performance_timing]= 1---600-600-600-400-400-----600-0----1608247177200--1608247176900--1608247176900--400- 400&&dimensions[actor_id]=47727044&dimensions[actor_login]=dessantbot&dimensions[actor_hash]= a274a9ae03a3b361483e273a53aba70534c609670c058fe667d8bce4d6f33bad&dimensions[cid]=1507727009.1608247109 [1] https://www.theregister.com/2020/12/17/github_will_no_longer_present/ https://www.theregister.com/2020/12/17/github_will_no_longer...
- 867-5309 6y ago
  this isn't about tracking users, it's about cookies. no cookies doesn't mean no tracking. it's just a workaround to improve UX. "visiting our website does not send any information to third-party analytics services" - but presumably third parties are still able to access this data on request. their privacy policy probably reflects this. if you visit a website and don't want to be tracked, make it as hard as possible for the host to do so, don't rely on what the host says. they can do anything they like with visitors' data. anyone who hosts websites will confirm this
  - dessant 6y ago
    Yes, they can do anything with the user's data, if the user has consented, or if they are willing to break the law. The tracking request you see above requires informed consent under GDPR, and GitHub does not ask for consent before collecting browsing and device data that is tied to GitHub usernames.
gcblkjaidfj 6y ago
> Tracking cookies have little value for GitHub when they can collect data about users that have already been authenticated This is true to every advertiser or data seller, Including obvious ones like Google, FB, Amazon... and less obvious ones like your ISP, Apple, etc. The industry call it persistent ID (as opposed to cookie, which are transient ID): https://digiday.com/marketing/wtf-persistent-id/ https://digiday.com/marketing/wtf-persistent-id/ (random result, i do not endorse it) The trick is: the publisher/intermediary have even more information about you, but they call you User-A instead of your name, so they can sell your history, zip, DNA, etc... just pretend not labeling the data with your name or some other personal identifiable information already listed in a Law somewhere makes everything fine.
- cedilla 6y ago
  History, ZIP and DNA already are personally identifiable information (PII). Pseudonymisation is in general not enough to avoid the GDPR and similar laws. And pseudonymisation would require the removal or obfuscation of all PII to the point that it is impossible to reconstruct the identity of the user. There's no specific list of information regarded as PII, it's PII if it can be used to identify the user, even if only in combination of the other PII. The GDPR is really quite broad there, other laws may be more lenient. However, the GDPR is not yet very strictly enforced or tested in court.
  - tripzilch 6y ago
    > Pseudonymisation is in general not enough to avoid the GDPR and similar laws. fortunately, "undermining the spirit of the law in order to continue to make a profit" is generally frowned upon in the EU, and lawmakers don't take too kindly to it. sometimes I get the feeling that in the US it's almost acceptable to publicly brag about doing this, like it's even more "socially" acceptable.
deepersprout 6y ago
> GitHub still sends the same personal data to their own analytics endpoint I see nothing wrong with that. Analysing your users on your own site is no problem for me. I should know what users do on my property. What's the problem you have with that?
- chopin 6y ago
  It's not GDPR compliant without consent. It doesn't matter whether you are using cookies or something else.
  - merijnv 6y ago
    Why is it not GDPR compliant. You do not need consent under the GDPR. You need a (documented) "lawful basis for processing" personal information. Consent is just one of several lawful bases and honestly it's the most useless one, if you need consent your business model is screwed. It's perfectly possible for GitHub to process personal information without explicit consent while not violating the GDPR. Several options come to mind: 1) consider analytics part of the "contract legal" basis, arguing that analytics to improve the usability of the website is a fundamental part of running a website. 2) The "legitimate interest" lawful basis, which states: > processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Arguing that improving the accessibility/usability is in the legitimate interest of both company and user. I'm fairly confident that, depending on which and what detail of personal information, both of these justifications will be accepted by EU courts.
    - tripzilch 6y ago
      > I'm fairly confident that, depending on which and what detail of personal information, both of these justifications will be accepted by EU courts. I believe they must also show that they don't store this data strictly longer than necessary. Which, in the case of analytics/usability would mean aggregating (and thus depersonalising) the data almost immediately. And if they do that, it will indeed be fine. Both with the letter, as the spirit of the law.

irrational 6y ago

What is the real value in a privacy policy? I assumed they were similar to EULAs - totally unenforceable. Are there actually any legal repercussions if they lie in their privacy policy? Or is it just ill will that might be accrued (and probably quickly forgotten) if they are found out to have violated their own privacy policy?

tsimionescu 6y ago
GDPR should have given some legal teeth to privacy policies.
- hetspookjee 6y ago
  I haven't seen a lot of repercussions, if any actually. I would've figured something big would've happened right now with the antics that are up, but here we are - necessary to download an _opt-out_ extension for Google Analytics. This couldn't be a more blatant disregard for the EU laws than I could imagine. And at the same time here in the Netherlands we have the party responsible for enforing laws handing out one, almost disproportionally large fine, to a small organisation each year. Like a 800k fine to a tennis unity because they were too aggressive in their data grievance, while all the big guys are still going at it and then some. Sorry for the rant but it's hard to stay optimistic, so seeing something like Github making a good move in the right direction, and seeing the post of plausible.io on the front page, this seems like a good day on the front of privacy.
1vuio0pswjnm7 6y ago
Violation of privacy policies alone does not give rise to a cause of action. However such violations could be useful as evidence in the context of suing on some other basis. Of course, there is no satisfactory basis to sue tech companies for violations of privacy. That is why privacy is being decimated by tech companies. There are no adequate laws to protect it. Privacy policies seem to be an effective way to placate the public. Users seem to take tech companies on their word.
mumblemumble 6y ago
It sounds like you have misunderstood the purpose of a privacy policy. It is very rare that I encounter one that is designed to protect the user's privacy. Far more often, it's there to protect the company. "I have read and agree to the privacy policy," is a coded way of saying, "I have read and agree to waive my claims to privacy, as outlined in the privacy policy."
- nobody9999 6y ago
  >Far more often, it's there to protect the company. That's pretty much true. And why shouldn't a group try to limit their liability? >"I have read and agree to the privacy policy," is a coded way of saying, "I have read and agree to waive my claims to privacy, as outlined in the privacy policy." That's often, but not always true. For example, here's a [sanitized] privacy policy I wrote for a website I set up for a specific (noncommercial) purpose: "[Site] Privacy Policy No personal information^ will be stored on the https://www.[site] https://www.[site] web server (except as specifically authorized), and every effort will be made to protect the integrity and privacy of such information. [Site], its management or assignees will never sell personal information collected on this site, nor will they use such information for purposes other than specifically related to the operation of the [Site] website and/or to facilitate the dissemination of information regarding [purpose of site] and other group activities related to [potential users] and other [user purpose] related group activities. Under no circumstances will street address or telephone number information be stored on the www.[site] by [Site], its management or assignees. [Site], its management and assignees will never, under any circumstances reveal email addresses, street addresses and/or telephone numbers to anyone without explicit authorization. From time to time, [site] may offer services to allow [potential users] to contact each other. For these services, [Site], its management and assignees makes no warrantee of fitness for any purpose, including maintaining the privacy of users' personal information. All personal information will be held in confidence and will only used for the purposes of the [potential users] [purpose of site] and official [membership organization] business. This business includes (but is not limited to) providing personal information for inclusion (by the [membership organization]) in a printed work to be published at a later date. If this published work is then used for illegal and/or nuisance purposes, [Site], its management and assignees disavow any responsibility or liability for the use of that information by third parties for any purpose. If a subscriber (limited to members of the [potential users]) chooses to share their personal information with other subscribers via any mechanism made available through the [Site] web site, mailing list or other conveyance provided by [Site], its management and assignees disavow any responsibility or liability for the use of that information by third parties for any purpose. Under no circumstances will [Site], its management or assignees be liable or otherwise legally responsible for the theft, misuse or other unauthorized use of personal information. Any person or entity registering on, providing contact information, or subscribing to the [Site] web site explicitly agrees to all the terms of this privacy policy. This policy applies to the www.[Site] web site and the [Purpose of site]@[Site] mailing list. If any portion of this policy is found, by any competent jurisdiction, to be invalid or unlawful, the remainder of this policy will continue to be in force. The terms of this policy may be modified at any time at the discretion of [Site]. It is the responsibility of the subscriber to review the terms of this policy on a regular basis. Current versions of this policy can be found at https://www.[site]/privacy.html https://www.[site]/privacy.html. ^Personal Information: Data such as street address, email address and telephone number which would enable direct contact with the subject of that information." It does two specific things: 1. Informs users how their PII will (and will not) be used; 2. Clarifies the liability of those who own/run the site. Unlike most "privacy" policies, there's nothing underhanded or privacy invading/data stealing involved. I wish more privacy policies were like that.

dessant 6y ago

A GitHub spokesperson has issued this statement [1] about a request to api.github.com: "That endpoint tracks aggregate performance metrics, and does not rely on cookies or other unique identifiers". GitHub is still sending our usernames and other unique IDs, our device data, and the pages we visit to the collector.githubapp.com endpoint. GitHub's claims about not tracking users are false, they do identify users in tracking requests. See this tracking URL, it's full of unique identifiers and personal data, and it is currently sent after every page load, without user consent: https://collector.githubapp.com/github/page_view?dimensions[page]=https://github.com/&dimensions[title] =GitHub&dimensions[referrer]=https://github.com/sessions/two-factor&dimensions[user_agent]=Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0&dimensions[screen_resolution]=1000x518&dimensions[pixel_ratio] =1&dimensions[browser_resolution]=1000x518&dimensions[tz_seconds]=0&dimensions[timestamp] =1608247177900&dimensions[referrer]=https://github.com/sessions/two-factor&dimensions[request_id]= 9CF8:4938:4516EA:5FD134:5FDBE77E&dimensions[visitor_id]=6475638196559144773& dimensions[region_edge]=fra&dimensions[region_render]=iad&&measures[performance_timing]= 1---600-600-600-400-400-----600-0----1608247177200--1608247176900--1608247176900--400- 400&&dimensions[actor_id]=47727044&dimensions[actor_login]=dessantbot&dimensions[actor_hash]= a274a9ae03a3b361483e273a53aba70534c609670c058fe667d8bce4d6f33bad&dimensions[cid]=1507727009.1608247109 [1] https://www.theregister.com/2020/12/17/github_will_no_longer_present/ https://www.theregister.com/2020/12/17/github_will_no_longer...

867-5309 6y ago
this isn't about tracking users, it's about cookies. no cookies doesn't mean no tracking. it's just a workaround to improve UX. "visiting our website does not send any information to third-party analytics services" - but presumably third parties are still able to access this data on request. their privacy policy probably reflects this. if you visit a website and don't want to be tracked, make it as hard as possible for the host to do so, don't rely on what the host says. they can do anything they like with visitors' data. anyone who hosts websites will confirm this
- dessant 6y ago
  Yes, they can do anything with the user's data, if the user has consented, or if they are willing to break the law. The tracking request you see above requires informed consent under GDPR, and GitHub does not ask for consent before collecting browsing and device data that is tied to GitHub usernames.

gcblkjaidfj 6y ago

> Tracking cookies have little value for GitHub when they can collect data about users that have already been authenticated This is true to every advertiser or data seller, Including obvious ones like Google, FB, Amazon... and less obvious ones like your ISP, Apple, etc. The industry call it persistent ID (as opposed to cookie, which are transient ID): https://digiday.com/marketing/wtf-persistent-id/ https://digiday.com/marketing/wtf-persistent-id/ (random result, i do not endorse it) The trick is: the publisher/intermediary have even more information about you, but they call you User-A instead of your name, so they can sell your history, zip, DNA, etc... just pretend not labeling the data with your name or some other personal identifiable information already listed in a Law somewhere makes everything fine.

cedilla 6y ago
History, ZIP and DNA already are personally identifiable information (PII). Pseudonymisation is in general not enough to avoid the GDPR and similar laws. And pseudonymisation would require the removal or obfuscation of all PII to the point that it is impossible to reconstruct the identity of the user. There's no specific list of information regarded as PII, it's PII if it can be used to identify the user, even if only in combination of the other PII. The GDPR is really quite broad there, other laws may be more lenient. However, the GDPR is not yet very strictly enforced or tested in court.
- tripzilch 6y ago
  > Pseudonymisation is in general not enough to avoid the GDPR and similar laws. fortunately, "undermining the spirit of the law in order to continue to make a profit" is generally frowned upon in the EU, and lawmakers don't take too kindly to it. sometimes I get the feeling that in the US it's almost acceptable to publicly brag about doing this, like it's even more "socially" acceptable.

deepersprout 6y ago

> GitHub still sends the same personal data to their own analytics endpoint I see nothing wrong with that. Analysing your users on your own site is no problem for me. I should know what users do on my property. What's the problem you have with that?

chopin 6y ago
It's not GDPR compliant without consent. It doesn't matter whether you are using cookies or something else.
- merijnv 6y ago
  Why is it not GDPR compliant. You do not need consent under the GDPR. You need a (documented) "lawful basis for processing" personal information. Consent is just one of several lawful bases and honestly it's the most useless one, if you need consent your business model is screwed. It's perfectly possible for GitHub to process personal information without explicit consent while not violating the GDPR. Several options come to mind: 1) consider analytics part of the "contract legal" basis, arguing that analytics to improve the usability of the website is a fundamental part of running a website. 2) The "legitimate interest" lawful basis, which states: > processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Arguing that improving the accessibility/usability is in the legitimate interest of both company and user. I'm fairly confident that, depending on which and what detail of personal information, both of these justifications will be accepted by EU courts.
  - tripzilch 6y ago
    > I'm fairly confident that, depending on which and what detail of personal information, both of these justifications will be accepted by EU courts. I believe they must also show that they don't store this data strictly longer than necessary. Which, in the case of analytics/usability would mean aggregating (and thus depersonalising) the data almost immediately. And if they do that, it will indeed be fine. Both with the letter, as the spirit of the law.