7 ms·
Gitlab's marketing page, that is. If you're going to claim Gitlab, as in the tool, has that, then link to an actual example repository for proper comparison.
by scrollaway 6y ago
Gitlab's marketing page, that is.
If you're going to claim Gitlab, as in the tool, has that, then link to an actual example repository for proper comparison.
Not trying to defend Gitlab here, but this headline makes it sound like you have an agenda.
(The page linked compares about.gitlab.com, which is a wildly different site than the rest of Gitlab)
- tomrod 6y agoUnethical behavior shouldn't be practiced on marketing pages or on product pages
- scrollaway 6y agoClickbait with an agenda would be unethical behaviour as well. Like i said, I'm not defending Gitlab. But there's a difference in impact between "theres 15 trackers in the tool i use" and "there's 15 trackers in the marketing page i never visit". Don't make it sound like you don't understand that difference.
- Nextgrid 6y agoIf the cookies and/or same origin policy are shared between the marketing page and the actual "business" pages then it doesn't matter - both sides should be considered compromised.
- deleted 6y ago[deleted]
- luke2m 6y agoNot affiliated with any company, just wanted to share something I found interesting. I don’t use the web UI much at all anyway. I did insert a repo url to the tool, but it redirected to the about page.
- tomrod 6y agoProtest to the contrary, you're defending Gitlab by saying "but the article hosting provider did shady things too!" Two wrong make no rights.
- rijoja 6y agoYeah and the keylogger part is at least stretching the truth.
- ellimilial 6y ago"There are other reasons for key logging, such as providing autocomplete functionality" - I don't think they're stretching anything.
- spzb 6y agoI think "keylogger" implies that keystrokes outside of your interaction with the webpage can be logged. This doesn't seem to be the case here.
- hvdijk 6y agoThat's not what they mean by "keylogger" and some reasonable people would agree with them on their naming. Suppose you have a log-in page, and a user name field, password field, and a "Log in" button. If a website secretly submits everything entered into the password field even when "Log in" isn't clicked, such as when a user accidentally pastes a password for another website and realises it before logging in, I think most people would call that a keylogger. In Gitlab's case, it seems to be their search function. It provides search results without needing to press Enter or clicking a button. From a technical POV, this is the exact same kind of keylogging as the above, it's only the intent that makes this okay and the above not so.
- _flux 6y agoWould you agree that keylogger is a term for malicious software with the purpose of stealing private data such as credentials? Is this is the case, then the latter is not keylogging. The former is some sort of logging, but I wouldn't call it keylogging; after all, you are still entering data to the particular filed intended for entering credentials, to be sent to the remote server for verification. If the purpose of the remote server is something more nefarious, then it is keylogging. The feature would even make sense if the server would let you in without pressing enter; but for understandable reasons this is not really a thing..
- KMnO4 6y agoI thought that too but running a random repository through that same tool isn’t any different.
- deleted 6y ago[deleted]
- the_duke 6y agoI tried the same thing. The tool doesn't handle the direct link, it just gives information for about.gitlab.com again.
- georgyo 6y agoThere is no ability to run a random page though that tool. It can only look at the root index page of the domain. And this mostly makes sense. It means they can cache results more easily, there is no way the tool could return so quickly unless it was cached.
- simonft-mrkp 6y agoYep, and this help mitigate abuse of the tool, e.g. someone continuously running it on every page of a website to slow the site down (I helped work on Blacklight)
- neurostimulant 6y agoIf that's the concern, can you put a rate limit on per-domain basis instead? Many other tools that scan websites allow you to scan arbitrary page url, not just root/index url.
- simonft-mrkp 6y agoWe could have, yeah. There are some UX questions there we'd have to answer, and we were developing this with a very small team and limited time, so opted for a simple solution. We did make the collection software available on Github if people want to check out arbitrary pages on their own: https://github.com/the-markup/blacklight-collector/ https://github.com/the-markup/blacklight-collector/
- duckfang 6y agoI scanned my own page on GL... And the findings are in parity with about.gitlab.com . Except there's 32 third-party cookies on my repo versus 22 on the marketing landing page (about.gitlab.com) So I'd classify it as worse than the marketing landing page. Doesn't see that wildly different.
- scrollaway 6y agoCan you link it? I can't get it to scan anything else than the homepage
- boleary-gl 6y agoAre you sure it scanned a repo and didn't redirect to the about.gitlab.com page? Can you provide a link to these results?
- luke2m 6y agoPlease share how you did this (it was my original intention)
- luke2m 6y agoThat’s what I intended to do, but blacklight redirected to the about page. I do not have an agenda: I use both GitLab and GitHub and am affiliated with neither. https://gitlab.com/luke2m/ https://gitlab.com/luke2m/
- scrollaway 6y agoI believe you, it's an easy mistake to make, but I do want to point out that the title is not appropriate for the claim. When I go to one of my repositories, ublock origin shows exactly one third party domain, assets.gitlab-static.net.
- squeaky-clean 6y agogitlab.com/ redirects to about.gitlab.com/ Seems like blacklight strips any url paths if you were trying to check your own repo url