Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gitlab cancels plan on tracking user behavior on GitLab.com

gitlab.com

Post reply on HN
Print view View original

211–220 of 285 posts

Re: Gitlab cancels plan on tracking user behavior on GitLab.com

#211

Post by jamiequint »

orf wrote: post #193
jamiequint wrote: post #181

Earlier quoted context omitted.

> I think part of the issue was that there are many cases where you can't send potentially sensitive information to a third party, regardless of their TOS. I don’t think this is true, provided the third-party is GDPR compliant themselves. It’s the controller-processor relationship under GDPR. Presumably if there was not a cutout for this, AWS would not be able to exist.

I'm not talking about GDPR specifically, I'm talking about embedding a third party script (or sending data to a third party) from a company that I have no relationship with. Many companies would find that unacceptable, especially within their source control. Where all their IP is hosted. The "can't" here isn't necessary legal, it could be internal.

I think that’s a fair point from a security standpoint, but there are clear technical solutions for sending telemetry data to third party scripts without allowing page access that are well established (e.g safeframes) yet the conversation isn’t about that. The conversation (more like coordinated uni-directional screeching) is instead an irrational moral panic which is not justified by the facts at hand.

I don’t see the fact that you have or don’t have a relationship with the company as relevant. The mechanism of passing of the data is just an implementation detail. You don’t have control over what relationships the company has on the backend (e.g. what if they store your telemetry data in BigQuery or Snowflake, or keep your log data in Loggly) so I don’t see how this expectation suddenly applies if the data is being sent from the frontend instead.

Re: Gitlab cancels plan on tracking user behavior on GitLab.com

#212

Post by TeMPOraL »

toomuchtodo wrote: post #12
liability wrote: post #10

Earlier quoted context omitted.

> "It's mind-boggling to me how entitled and aggressive the open-source culture is allowed to be." 'Allowed' to be? The "open source culture" is the sum of the participants and participation is open to the general public. If being rude were "not allowed" who would be doing the not allowing and why should they be so empowered over members of the general public?

This assumes all participation is equal. This is not the case. It’s GitLab’s sandbox, their rules (including not being crass if desired). How is this different than what would be expected with a Code of Conduct? Must one call out “Don’t be a dick”? Vigorous debate is to be expected, being rude is not.

> It’s GitLab’s sandbox, their rules (including not being crass if desired).

They can ban people who clicked on the "Reversed Hand With Middle Finger Extended" emojis. If it's against their rules, they should (otherwise there's no point in having rules in the first place). That said, if the emoji is in their system (and it's not there by accident), it probably serves a purpose. In this case, it accurately represents the sentiment of people who gave that feedback.

> How is this different than what would be expected with a Code of Conduct?

No different at all; Codes of Conduct exist primarily to signal allegiance or submission to the social justice crowd. They introduce nothing new on top of regular rulesets that existed in on-line communities since on-line was a thing.

Re: Gitlab cancels plan on tracking user behavior on GitLab.com

#213

Post by TeMPOraL »

sigzero wrote: post #116
colechristensen wrote: post #60

Earlier quoted context omitted.

What? >I don’t understand. This should not be an opt in or an opt out. It is a condition of using our product. There is an acceptance of terms and the use of this data should be included in that. In what way is that "nasty"?

It's "clueless" but not "nasty".

It's either extremely clueless or nasty, but regardless, it also expresses a suggestion that's hostile to the users.

Re: Gitlab cancels plan on tracking user behavior on GitLab.com

#214

Post by TeMPOraL »

mobjack wrote: post #174
jamiequint wrote: post #166

This is incredibly dumb. Both Pendo and Snowplow are analytics providers, meaning they both have in their TOS that the company remains the owner of the data in question and that the services only exist to facilitate analysis of the data in question. Effectively this is users complaining that Gitlab wants to simplify their data analysis overhead. Presumably nothing precludes them from sending the exact same data to th…

There is a lot of FUD whenever someone mentioned third party because many don't know the difference between a dedicated analytics provider and Facebook.

How would you know a difference, how could you trust the difference (given the adtech industry being what it is), and how can you know things won't change over time? All that without being in a contractual relationship with that third party.

Re: Gitlab cancels plan on tracking user behavior on GitLab.com

#215

Post by jamiequint »

jackcodes wrote: post #182
jamiequint wrote: post #166

This is incredibly dumb. Both Pendo and Snowplow are analytics providers, meaning they both have in their TOS that the company remains the owner of the data in question and that the services only exist to facilitate analysis of the data in question. Effectively this is users complaining that Gitlab wants to simplify their data analysis overhead. Presumably nothing precludes them from sending the exact same data to th…

What about running third party scripts on the page, which would have access to all code on the account you’re logged in with? How do organisations audit these scripts, and how can they audit new versions of these scripts when gitlab controls the release strategy of these scripts? You’d be moving from one (possibly two if you include the cloud provider) vendors having theoretical access to all of your code to four ven…

Any vendor Gitlab works with already has potential access. Just because you have a known front-end attack vector doesn’t mean you’ve gone from 1 to 4. You’ve been at N the whole time, it just hasn’t been as visible.

FWIW I agree that on-page JS on pages with source code is a terrible idea, but that’s easily fixable and doesn’t seem to be at the root of the issue.

Re: Gitlab cancels plan on tracking user behavior on GitLab.com

#216

Post by jamiequint »

TeMPOraL wrote: post #214
mobjack wrote: post #174

Earlier quoted context omitted.

There is a lot of FUD whenever someone mentioned third party because many don't know the difference between a dedicated analytics provider and Facebook.

How would you know a difference, how could you trust the difference (given the adtech industry being what it is), and how can you know things won't change over time? All that without being in a contractual relationship with that third party.

Are you in a contractual relationship with AWS for every service you use that uses AWS on the backend? How about Loggly? How about BigQuery/Snowflake? Intercom if they use that? Salesforce? Facebook and Google if they run ads? They may not do anything weird with your data now but how can you know that things won’t change over time?

Re: Gitlab cancels plan on tracking user behavior on GitLab.com

#218

Post by TeMPOraL »

jamiequint wrote: post #216
TeMPOraL wrote: post #214

Earlier quoted context omitted.

How would you know a difference, how could you trust the difference (given the adtech industry being what it is), and how can you know things won't change over time? All that without being in a contractual relationship with that third party.

Are you in a contractual relationship with AWS for every service you use that uses AWS on the backend? How about Loggly? How about BigQuery/Snowflake? Intercom if they use that? Salesforce? Facebook and Google if they run ads? They may not do anything weird with your data now but how can you know that things won’t change over time?

GDPR.

Re: Gitlab cancels plan on tracking user behavior on GitLab.com

#219

Post by orf »

jamiequint wrote: post #211
orf wrote: post #193

Earlier quoted context omitted.

I'm not talking about GDPR specifically, I'm talking about embedding a third party script (or sending data to a third party) from a company that I have no relationship with. Many companies would find that unacceptable, especially within their source control. Where all their IP is hosted. The "can't" here isn't necessary legal, it could be internal.

I think that’s a fair point from a security standpoint, but there are clear technical solutions for sending telemetry data to third party scripts without allowing page access that are well established (e.g safeframes) yet the conversation isn’t about that. The conversation (more like coordinated uni-directional screeching) is instead an irrational moral panic which is not justified by the facts at hand. I don’t see t…

In the self hosted instances, which is what I was talking about, you do have a control over the backend. At last more than you do with the managed version. It pretty much boils down to this: Can something leak sensitive information to a third party. If so, then it's a no go.

If you have a contract with that third party, and you deem that third party to be a safe harbour for your data (yes, that includes gitlab.org, AWS, etc), then that's a different case.

If Gitlab was to have instead said:

1. We are going to enable telemetry on all public repositories on Gitlab

2. On self-hosted instances we will provide you with the ability to embed your own analytics, from a company of your choosing

Then the screeching (and I fully agree it is screeching) would have been less. Unfortunately, with self-hosted instances, you simply cannot allow Gitlab to leak information like that to a company you don't have a direct relationship with. I'm not sure how else to phrase this concept or explain it, and it doesn't really matter if you use safeframes or not.

Re: Gitlab cancels plan on tracking user behavior on GitLab.com

#220

Post by [deleted] »

TeMPOraL wrote: post #206
scotth wrote: post #200

Earlier quoted context omitted.

If I had a guarantee from Gitlab that _they_ were scrubbing the data, I would have no problem. I get the sense they know what they're doing (naive, maybe) However, giving a third party script, potentially unvetted, access to the crown jewels of the company I work for? No fucking way. Different. Not a double standard.

They are tracking things anonymously at least in some places, judging by what I've read in the linked Gitlab issue tracker threads. The debacle started with someone higher up requesting to start recording user ID with that data, in order for the "growth team" to be able to do "experiments".

[deleted]
Post reply on HN