16 ms·
User tracking inspection result for about.gitlab.com
- luke2m 5y agoIronically, Microsoft is told when you visit GitLab.
- ta988 5y agoDo we know why? Is it for Bing?
- panny 5y agoAnd is funded by CIA's in-q-tel.
- smcleod 5y agoCan you give some more details and context about this please?
- leesalminen 5y ago“… has drawn the support of In-Q-Tel as a strategic investor.” https://about.gitlab.com/press/releases/2019-01-22-gitlab-announces-support-for-common-access-cards.html https://about.gitlab.com/press/releases/2019-01-22-gitlab-an... Background on In-Q-Tel https://en.m.wikipedia.org/wiki/In-Q-Tel https://en.m.wikipedia.org/wiki/In-Q-Tel
- smcleod 5y agoThank you!
- ta988 5y agoI guess they mean that Gitlab is funded in part by In-Q-Tel. In-Q-Tel is a VC started by the CIA (https://www.npr.org/sections/alltechconsidered/2012/07/16/156839153/in-q-tel-the-cias-tax-funded-player-in-silicon-valley https://www.npr.org/sections/alltechconsidered/2012/07/16/15...) that now is used by many actors of the IC. It also has a side effect of making gitlab inaccessible in some export restricted countries.
- smcleod 5y agoThank you, interesting - I'd heard about the export restrictions but that applies to a lot of software developed in the USA.
- dijit 5y agoThe keylogger is detected because of hotkey actions. https://docs.gitlab.com/ee/user/shortcuts.html#repository-graph https://docs.gitlab.com/ee/user/shortcuts.html#repository-gr...
- mschuster91 5y agoThe report specifically mentions that data is being sent off to HotJar, a session recorder service.
- opheliate 5y agoThat doesn't appear to align with what the Blacklight results actually say: "Blacklight detected a script belonging to the company Swiftype, Inc. doing this on this site." Presumably this is being used for autocomplete/search functionality, but it is a third-party script, not just Gitlab hotkeys.
- scrollaway 5y agoGitlab's marketing page, that is. If you're going to claim Gitlab, as in the tool, has that, then link to an actual example repository for proper comparison. Not trying to defend Gitlab here, but this headline makes it sound like you have an agenda. (The page linked compares about.gitlab.com, which is a wildly different site than the rest of Gitlab)
- tomrod 5y agoUnethical behavior shouldn't be practiced on marketing pages or on product pages
- scrollaway 5y agoClickbait with an agenda would be unethical behaviour as well. Like i said, I'm not defending Gitlab. But there's a difference in impact between "theres 15 trackers in the tool i use" and "there's 15 trackers in the marketing page i never visit". Don't make it sound like you don't understand that difference.
- Nextgrid 5y agoIf the cookies and/or same origin policy are shared between the marketing page and the actual "business" pages then it doesn't matter - both sides should be considered compromised.
- deleted 5y ago[deleted]
- luke2m 5y agoNot affiliated with any company, just wanted to share something I found interesting. I don’t use the web UI much at all anyway. I did insert a repo url to the tool, but it redirected to the about page.
- tomrod 5y agoProtest to the contrary, you're defending Gitlab by saying "but the article hosting provider did shady things too!" Two wrong make no rights.
- deleted 5y ago[deleted]
- cyberlab 5y agoI always wondered about JS-powered keyloggers. What if you type your Linux admin password, or other sensitive things by accident into the webpage and it all gets scooped up? Yes: the keylogger would have a privacy policy in place, but it irks me to think I could accidentally reveal my dearest secrets into some nosy webpage.
- googillionaire 5y agoThere are other ways that could happen, too, for example a chat window or a search bar. Change your password asap.
- gspr 5y agoAnd if you're running X: any window can just decide that it wants your keystrokes anyway.
- iamacyborg 5y agoThis, but with everyone using Grammarly which is effectively a keylogger browser extension.
- jfk13 5y agoFortunately for me, Grammarly has so alienated me with its relentless, irritating ads that there is no possibility that I will ever install it.
- KMnO4 5y agoThe “key logger” is the search autocomplete powered by Swiftype.
- ellimilial 5y agoAnd they point that out: "There are other reasons for key logging, such as providing autocomplete functionality"
- ainiriand 5y agoSo it is true that all you type goes to a third party. Sounds like a keylogging feature to me.
- ddevault 5y agoMeanwhile, my services do not have, and have never had, any software which spies on you. https://themarkup.org/blacklight?url=sourcehut.org https://themarkup.org/blacklight?url=sourcehut.org Check out codeberg too: https://themarkup.org/blacklight?url=codeberg.org https://themarkup.org/blacklight?url=codeberg.org If you care about this, you should be casting your lot with services that care about your privacy and don't include your personal information in their valuation.
- opheliate 5y agoI know that anyone who recognises your username will immediately understand your affiliation to sourcehut, but it's not listed on your profile, nor is it immediately obvious from your website, so perhaps it would be a good idea to indicate your ownership in your comment?
- ddevault 5y agoWhoops, good call. Made some edits.
- deleted 5y ago[deleted]
- the_duke 5y agoYour constant promotion of Sourcehut on unrelated topics really leaves a bad taste in my mouth and turns me off wanting to use the service. It comes off as highly unprofessional.
- ddevault 5y agoSorry? How is this unrelated? SourceHut provides similar services without the spyware. Seems highly relevant to this thread.
- the_duke 5y agoIt's cheap marketing. You are one of relatively few people regularly trying to (ab)use Hackernews comments for promoting your own product. If you want to show how privacy friendly you are, write a blog post about it and try to get it upvoted here.
- pcl 5y agoWhen I go to a repository hosted on GitLab (https://gitlab.com/gitlab-org/gitlab https://gitlab.com/gitlab-org/gitlab, for example), Safari tells me that there are no trackers. I have different feelings about trackers on the marketing portion of a site vs. the product portion of the site.
- imwillofficial 5y agoAs others have said, this is a misleading title.
- ainiriand 5y agoMy problem here is to understand the angle here. Why does a paid tool, one of the best out there, insert 16 ad trackers in its own site? What purpose does it even serve? Why does Facebook even care or why does it have to be informed about my visit? This ad business is crazy stuff. Lucky for me I have some blockers for things like this.
- DethNinja 5y agoIt is actually fairly common, Gitlab puts hundreds of different ads to Facebook and it has to track which one of these ads actually work and cancel the ones that don’t result in profit. Most noble thing to do would be using server-side tracking/analytics but because of additional coding and losing access to Facebook analytics, most web sites usually don’t bother.
- MereInterest 5y agoI'd go one step further, and say that the most noble thing would be to have a direct <a href="advertised-site">, and not track the user clicks at all. Even server-side tracking of <a href="local-redirect?where=advertised-site&id=user_id"> involves tracking beyond what is minimally necessary to provide a service.
- ta988 5y agoI guess the problem is that it could be faked? You just hire a botnet and make it hit those links to make your ad company look good.
- MereInterest 5y agoTrue, though I'm undecided on whether that justifies tracking clicks. The fundamental problem is that neither that advertisers nor the websites trust each other. If the advertisers trusted the website, then the Referer header would be sufficient for the advertiser to know where clicks came from, and the website host could verify that those are correlated with their own server logs. However, this would require a cost, in terms of refusing to do business with untrustworthy websites. Rather than accepting that as a fact of the business, websites/advertisers instead push the cost off to users as an externality. This cost is paid by the user in time/bandwidth (larger page load times) and privacy (ad trackers), even though they were by no means the source of the problem.
- vbsteven 5y agoRunning the same tool on my selfhosted Gitlab instance comes up clean.
- elygre 5y agoThe report does not apply to the gitlab application, but to the gitlab marketing page. I think it’s a clickbait title, for that reason.
- jeffgreco 5y ago> On the site you are inspecting, information entered in the name, family-name, given-name fields were logged. That doesn’t sound like “autocomplete purposes” to me.
- williesleg 5y agoNice! I'd love to look at that source code and build my own!
- bassdropvroom 5y agoMaybe I'm missing how themarkup.org works, because I just had a look through the uBlock Origin log, and this seems to be vastly overstated. Looking through the source I don't see anything Facebook/Twitter related except for metatags for Facebook/Twitter. I don't see any Microsoft, LinkedIn trackers or anything as per uBo's logger. Regardless, I have seen other sites that have a vast amount of trackers so I'm gonna ask my question anyway. Anyone know what the point is of having this many trackers? I totally understand that a company wants to figure out how a user interacts with their app, but what is the point of tracking using different trackers where there is a lot of functionality overlap. I doubt Microsoft, Google, Twitter, Facebook and whoever else collect vastly different data where this becomes useful. Maybe one or two different companies e.g. for redundancy but why do their need more than that?
- simonft-mrkp 5y agouBlock Origin with some filter lists (I suspect the easy privacy is one) will block calls to google tag manager, which prevents anything that would have been loaded by that from showing up in ublock origin's block list. I suspect that's what's happening in this case. If I load about.gitlab.com without ublock origin enabled the FB network requests show up in in the network console.
- viraptor 5y agoEach company will want a ping related to their own tracking tags. I.e. if the visitor came from a Facebook ad, you want to notify FB about conversions so that you know how effective the ad was. Also it's required if you want some dynamic A/B behaviour on the referrer side. Multiply by each source (not just ads). All of that could be done server side, but people don't want to build their own version of analytics, run it internally, and keep it up to date with all their data sources.
- EveYoung 5y agoIn many cases it's about running retargeting ads on multiple platforms and tracking campaigns. For example, you might want to run ads on LinkedIn only for users who have visited your page.
- secondcoming 5y agoold.reddit.com seems to have fingerprinting [0] whereas www.reddit.com doesn't [1] slashdot seems to have all the trackers [2] [0] https://themarkup.org/blacklight?url=old.reddit.com https://themarkup.org/blacklight?url=old.reddit.com [1] https://themarkup.org/blacklight?url=www.reddit.com https://themarkup.org/blacklight?url=www.reddit.com [2] https://themarkup.org/blacklight?url=slashdot.org https://themarkup.org/blacklight?url=slashdot.org
- swiley 5y agogitlab is awful. There is way too much front end code and I honestly wouldn't be surprised if the only way to fix it is to tear it all out and start over.
- dmor 5y agoGood morning HN. I am the DRI (directly responsible individual) for about.gitlab.com and I have created this issue to audit our trackers, cookies, and other data collection on the marketing website https://gitlab.com/gitlab-com/marketing/inbound-marketing/marketing-website/-/issues/125 https://gitlab.com/gitlab-com/marketing/inbound-marketing/ma... Our product does not include the tracking that is used on the marketing site.