7 ms·
Sentry new TOS to use data to train AI with no opt-out
- csomar 3y agoImportant bit: Updated Sentry’s data usage rights to include the right to use Service Data for AI model training and other product development efforts. Effective on Februrary 3, 2024; so essentially less than 30 days to find a new provider.
- luke-stanley 3y agoOr to setup one, I think spinning up with Docker Compose with a slightly older version should be possible, last I checked.
- mertbio 3y agoIf you are looking for an alternative after this change, I can highly recommend AppSignal: https://www.appsignal.com/ https://www.appsignal.com/ They are based in The Netherlands so I don’t expect them to come up with something like this.
- mbix77 3y agoCountry doesn't have anything to do with it. Maybe think about self-hosting something if you are concerned about those things. Something like Signoz: https://github.com/SigNoz/signoz https://github.com/SigNoz/signoz
- buildfocus 3y agoIf you're migrating from sentry to self hosting, you might as well just self host Sentry itself no? I've never tried myself, but it seems relatively straightforward: https://develop.sentry.dev/self-hosted/ https://develop.sentry.dev/self-hosted/
- pranay01 3y agoHave not tried myself but heard from multiple folks that self hosting sentry is not easy
- lazy_moderator1 3y agoi've been doing it for years with zero issues, took like 10 minutes to set up
- frenchman99 3y agoI've seen it self-hosted too, worked fine with little to no maintenance. https://develop.sentry.dev/self-hosted/ https://develop.sentry.dev/self-hosted/
- dewey 3y ago> They are based in The Netherlands so I don’t expect them to come up with something like this. What is this supposed to mean?
- mertbio 3y agoThey are GDPR compliant.
- dewey 3y agoWhat makes you think Sentry is not? https://sentry.io/trust/privacy/ https://sentry.io/trust/privacy/
- RamblingCTO 3y agoThe very move of this is a GDPR violation and doesn't stand a chance in EU courts.
- jsmeaton 3y agoHow? Which part is a violation?
- RamblingCTO 3y agoYou cannot just update the TOS including something which warrants a consent.
- DanRubins 3y agoI dunno, maybe the utter lack of consent or legal basis for processing?
- the_mitsuhiko 3y agoWe (Sentry) absolutely uphold GDPR and all data privacy directives, even in the face of machine learning.
- traskjd 3y agoI’m JD, co-founder of Raygun (https://raygun.com https://raygun.com). We’re a paid alternative in crash report logging and user performance metrics. We’ve been operating for years, not reliant on VCs, and are HQ’d in New Zealand. I’ve met with many customers over recent months who have told me quite plainly that they have been told none of their data is to go into any AI/LLM system. This is often coming from legal and many understand this may not apply forever, but for now it’s a hard no. While many of these were large organizations, the message was almost universal. To that end, at Raygun we have always run the business as though all data we receive is the customers’ data. Treat it how I’d want our data treated by one of our suppliers. As we look to release our own AI capabilities this year, we’ve been making it clear that these will be opt-in features. We take the role of being trusted with customer data very seriously, and the trust that is placed in us. We’re already compliant with standards like GDPR and tracking what’s coming around AI rules is something I think we’re all paying close attention to also. Happy to chat with anyone looking, can match budgets: jdtrask@raygun.com
- drdrek 3y agoOnly on free accounts, on paid accounts its up to current pay period expiration
- deleted 3y ago[deleted]
- adhamsalama 3y agoWhat would they benefit from this? Why do they have anything to do with AI at all?
- eigenket 3y agoMaybe they want to sell their user's data to people training AIs rather than training them themselves?
- buildfocus 3y agoI can imagine there lots of practical ways they can use AI - guessing the cause & solution of issues (this seems to be an off by one error, or you might want to check for null values on this line), automatically finding & linking you to related code for new errors (this failing connection was probably created over here), and detecting which errors are important and which are noise that you can ignore (the biggest problem with Sentry in my experience). In each case, training on their existing data will help a lot with this. All of that would be future product development, but I suspect this addition is for exactly that reason: so they can begin to prepare the ground for later development, not because they're going to immediately roll this out tomorrow.
- zachthewf 3y agoIf I were running product at Sentry I'd be working on an agent that opened pull requests to fix your Sentry errors. This would work today with GPT-4 on a nontrivial number of errors/codebases.
- LunaSea 3y agoThis would definitely not work in most bug cases just based on the fact that context size is too short and models too dumb. If you have a "can't access key 'foo' of undefined" error, adding a check if the object is undefined or not is not a fix. It's simply silencing the error. The bug might be way, way down in the stack, maybe even in the backend or somewhere else in the client that made the backend store invalid data my mistake. I highly doubt that the current breed of models are capable of this.
- rvz 3y agoLooks like the AI pied pipers and the VCs have pressured Sentry to add this useless change that no-one asked for to make themselves look like an AI company because of the hype. Why?
- sjfjsjdjwvwvc 3y ago[dead]
- cybrox 3y agoManagement see hype Management see money
- earthnail 3y agoLots of negative comments here. No opt-out sucks but afaics the AI they’ll train will be purely useful to their customers. “You received exception XYZ; check these issues which might be the cause.” That’s quite a cool assistant to have and very much on the safe side. I can always choose to ignore the AI’s advice.
- andersa 3y agoAll fun and games until that AI model accidentally reveals confidential technical details about issues you have/had to competitors.
- frenchman99 3y agoThat has nothing to do with AI though. That has to do with security engineering. Sentry could accidentally leak data without AI just as they could use AI in a secure way.
- andersa 3y agoSure, but you can't do security engineering if you're training an AI model on the data. It turns the whole thing into vibes-based programming.
- drdrek 3y agoYes, you are correct. And even more specifically its a legal issue. The old TOS guaranteed to enforce data separation and now it does not. Its not about the technology, its about loosening constrains on user generated data. Do you think I care if they expose my data through LLM or heuristics based recommendation engine? This is not cake pictures from Instagram, it has legal ramifications.
- ProllyInfamous 3y ago$$$ Tee $$$ Hee $$$
- makeavish 3y agoUsing user's private with no opt-out option is unethical. If anyone is looking self-hosted for alternatives then they should try SigNoz: https://github.com/SigNoz/signoz https://github.com/SigNoz/signoz
- JimDabell 3y agoI took a quick look at this. Is SigNoz primarily for server observability? One thing I’ve used Sentry for a lot in the past is client-side logging – client-side JavaScript, native iOS, and native Android. SigNoz doesn’t do that as far as I can see?
- scottishbee 3y agoThere are a handful of platforms you might want to look at for mobile: * Datadog has a mobile option: https://www.datadoghq.com/monitoring/mobile-application-monitoring/ https://www.datadoghq.com/monitoring/mobile-application-moni... * New Relic does too: https://newrelic.com/platform/mobile-monitoring https://newrelic.com/platform/mobile-monitoring * Embrace is Mobile only: https://embrace.io/ https://embrace.io/ Full disclosure, I work for one of these companies
- pranay01 3y agoHey - SigNoz maintainer here. we primarily focus on Application Performance monitoring (APM), Distributed Tracing, Logs management, Infra monitoring & Exceptions monitoring. We have some features for Client side monitoring, but it's not as advanced as of now (though it's in our roadmap) You can do basic client side monitoring if your application is in JS though - https://signoz.io/docs/tutorial/instrumenting-angular-frontend/ https://signoz.io/docs/tutorial/instrumenting-angular-fronte...
- Oras 3y agoI will get a hell of down votes for this, but why logs matter? If you’re logging personal or sensitive data, then you should reconsider your logging instead of changing the provider. That said, I think there should be a legislation about companies changing their TOS whenever they want without consequences.
- LunaSea 3y agoBecause logs contain also unexpected errors which could have personal data or product internal details which could leak to the outside.
- zeeg 3y agoIts not just simple logs at the end of the day, so there are two things to be aware of: 1. Logs will, no matter how well you do your job, contain something sensitive. Typically this ends up being customer data (PII). PII is the largest customer to most customers. 2. IP is _very_ present in logs, and especially in the types of data Sentry gathers (e.g. stacktraces). While not everyone is hyper sensitive to their code being on other systems, some companies treat it much more seriously. One particular example is the gaming industry, where projects are kept tightly under wraps and often take a decade+ to commplete. Regarding your note on the Tos Change, ours (Sentry's), and every other coroporate ToS I've ever looked at, always included some kind of clause to allow a change within a time window, without updated consent. As an implementor I understand the need for this (think about maintaining old versions of software, same paradigm), but as a customer I understand your sentiment as well. That said, many customers end up on annual terms of service with slight variants, particularly larger customers. This is a typical negotiation process as many of the needs/demands of organizations vary slightly.
- amichal 3y agoI wonder if this is just them aligning themselves with the new EU AI Act at the same time that they are rolling out a EU region[1]. From my understanding that act, soon to take affect makes it a requirement to explicitly explain the use cases for AI in your use of data in TOS. Before this law you didn't really have to say if you used AI [1] https://blog.sentry.io/sentrys-eu-data-region-now-in-early-access/ https://blog.sentry.io/sentrys-eu-data-region-now-in-early-a...
- the_mitsuhiko 3y agoHi, Armin from Sentry here. I wrote a blog post alongside the TOS change that goes into details here that addresses some of the questions I hope: https://blog.sentry.io/ai-privacy-and-terms-of-service-updates/ https://blog.sentry.io/ai-privacy-and-terms-of-service-updat... I'm also happy to answer specific questions about the TOS change or what we're intending on using. As for the opt-out: given the scope of how we are using usage and service data it did not seem all that obvious an opt-out was needed. We did receive the feedback however and will follow up here.
- ProllyInfamous 3y ago>...and will follow up here >...happy to answer specific questions JFC, how much are your overlords paying you for such corporate drivel..? There is no discussion to be had, here. Such a service ought'ta LEGALLY be `opt-in`, and inability to even opt-out is also INTENTIONAL.
- the_mitsuhiko 3y agoOur terms of service are historically very restrictive. Unlike many others in the space they do not permit us to use event data for analysis or improvements of the service. For instance SigNoz was mentioned in the thread here, their terms of service already contain a similar clause. I'm not sure how many companies offer opt-outs for that.
- ProllyInfamous 3y ago>historically How'bout now-ly? Can you honestly say that the lack of opt-out wasn't planned?
- the_mitsuhiko 3y agoClauses in terms of services for using event and usage data for product improvements without an opt-out are quite common place. Here the equivalent clause from Datadog: > In order to provide and support the Service for the benefit of Customer, Customer hereby grants Datadog a worldwide, non-exclusive, royalty-free license […] Customer agrees that, so long as no Customer Confidential Information is publicly disclosed, Datadog may: (i) use Customer Data to refine, supplement or test Datadog’s product and service offerings; (ii) include aggregated and anonymized Customer Data in any publicly available reports, analyses and promotional materials; and (iii) retain anonymized, non-attributable Customer Data following any termination of this Agreement for use in connection with the foregoing.
- deleted 3y ago[deleted]
- Annuity3036 3y agoAnother service went down the drain just because they want to exploit its user data.
- zeeg 3y agoDavid from Sentry- I just wanted to say that we've heard your feedback and are going to follow up. I'm not going to say we'll make any changes to the ToS, but there is at least a huge lack of clarity and clearly some triggering language in a number of things. There are many things we want to be able to do - much completely unrelated to the current generation of LLMs - that we simply cannot due our current set of terms. A good example of something that you might not care about, but is not explicitly clear in our terms: can we show your production average latency comparies to other applications? What about other web services? Other Python web services? I think we can all agree we missed the mark on comms here, and we may need to clarify and/or re-think part of the data use strategy. We certainly are not intending to funnel customer IP or PII into a random chatbot, and at the end of the day trust is involved in these things as we cannot explicitly label every feature we have built or plan to build within our ToS. While I dont think HN often represents our customer base 1:1, I do know our customer base also lurks here, and data security is and always has been of utmost importance to us. That isn't changing, and there's no conspiracy with investors or anything else going on.
- scottishbee 3y ago> can we show your production average latency comparies to other applications? This is pretty standard: many companies explicitly add contract language to NOT be included in these benchmarks. The reasons should be obvious, offering these benchmarks on increasingly narrow segments walks right up to betraying competitive information. source: I work at another observability company where we DON'T share our customers information with each other
- drfuzzyness 3y agoSentry customer here, I understand that you don't want to be in the business of sharing your customer's IP, but it's hard to not see using your customer's internal diagnostic data for training as exactly that. A universal opt-out of sharing data for training would go a long way in assuring me that I'm not about to find out that another customer is getting a snippet of quasi-private information (not sensitive to be PII, but not public enough to share). I can imagine that this'll be fine for a lot of customers but it makes me very uneasy. Heck, you could probably incentive some users into sharing their data by gating "AI" features behind not opting-out.
- nancyp 3y agoDiscussed here yesterday https://news.ycombinator.com/item?id=38871037 https://news.ycombinator.com/item?id=38871037