Gitlab cancels plan on tracking user behavior on GitLab.com

https://gitlab.com/gitlab-org/growth/product/issues/164

by tyteen4a03 • 7 years ago

602 271 7 years ago

gitlab.com

tyteen4a03• 7 years ago

This comment, from the CFO, is particularly nasty: https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#no...

user98372• 7 years ago

I wonder if Microsoft not allowing full telemetry opt-out in Windows 10 opened a precedent for this kind if thing.

kgwxd• 7 years ago

At least they said what they actually thought and opened a discussion instead of spewing one of the standard canned PR statements. The replies are a pretty good source of arguing against the position he took and now can be referenced by anyone else having a similar discussion.

user98372• 7 years ago

Did they said that because they always speak they're minds or because forced telemetry is becoming a norm? We will never know I guess.

zapita5• 7 years ago

You may or may not agree with that comment, but it is not nasty. What is nasty, on the other hand, is the vitriolic reaction to it. So far I count 16 "middle finger" emojis, including one with the subtitle "incompentent or malicious CFO". In what world does a disagreement over the right level of telemetry justify this kind of behavior?

It's mind-boggling to me how entitled and aggressive the open-source culture is allowed to be. Does a company like Gitlab really deserve to have its employees publicly insulted in this way, after giving away so much to their users, for free, and being so much more transparent than 99% of tech companies?

At this point I don't understand why anyone in their right mind would go to the trouble of making their product open-source. It's just not worth it.

liability6• 7 years ago

"It's mind-boggling to me how entitled and aggressive the open-source culture is allowed to be."

'Allowed' to be? The "open source culture" is the sum of the participants and participation is open to the general public. If being rude were "not allowed" who would be doing the not allowing and why should they be so empowered over members of the general public?

bachmeier2• 7 years ago

"At this point I don't understand why anyone in their right mind would go to the trouble of making their product open-source. It's just not worth it."

Umm...that's their business model. It's not an act of generosity. It was a decision that they thought was in their best interest.

Do you also think Facebook and Google are making their products free out of the goodness of their hearts?

badloginagain• 7 years ago

The reactions came after the comment was widely publicized. With wide publication comes the trolls. The original comment was thoroughly thumbs-down, but the only ones interacting were people who actually use/follow the product.

How any C level position blindly walks into this kind of thing in a post Cambridge-Analytica world is a different conversation.

ddevault• 7 years ago

<disclaimer: founder of a GitLab competitor>

When a C-level fundamentally misunderstands the company's culture and the culture of their target audience, incompotence becomes presumable and maliciousness becomes possible, IMO.

benatkin• 7 years ago

This doesn't have anything to do with it being open source. It's a separate movement called Open Company, which was tried by Gittip/Gratipay. It's mostly irrelevant to the open source-ness of a product whether the company's website is open source.

falcor843• 7 years ago

Gitlab is a wonderful company, but it's still a for profit company, it's not a charity. Everything they're giving away for free is part of the business model, and particularly part of their user acquisition approach. They, and many other companies, have discovered that the open source (or in this case "open core") approach can be very profitable.

I'm not advocating in favor of rudeness, but the same reasoning goes for the middle finger gesture. It's an emoji that Gitlab have (I believe) deliberately included in their commenting mechanism. As far as I understand, it acts as a way to categorize users' anger and vitriol in a much more sanitized manner than if the users were to type their sentiment into the comment box. In general, allowing and encouraging negative feedback of specific parts of the service helps drive user engagement and demonstrably makes good business sense.

If users feel entitled and free to speak up, it's because there is a lot of competition in this area and they can easily leave. The fact that users are providing this feedback to Gitlab, rather than just deleting their users is a sign that they still trust the company and the service, want to keep using it and to drive it to be better.

baddox2• 7 years ago

Assuming we're all using the word "nasty" to mean spiteful or unpleasant, I think it's quite fair to call that comment by the CFO nasty toward users. The CFO is literally saying that users should not have a choice about how their data is used. Now, that may be a "reasonable" business decision for GitLab to make, but it's still quite fair to call it nasty toward users. Again, it's literally the CFO instructing the GitLab product team to remove a choice from their users about how their users' data is being used. Middle fingers and feelings of entitlement may also be nasty, but this comment from the CFO is, in my view, pretty much textbook nasty.

madprops• 7 years ago

It's a way to send a message across. Before things turn irreversibly nasty.

Accacin2• 7 years ago

In what world does a disagreement over the right level of telemetry justify this kind of behavior?

In a world where companies think little of collecting and selling our personal data to make a profit? In a world where companies feel the need to track every part of my life with or without my permission. This is something I can't escape, as every time I interact with someone that does use one of these platforms than they are able to collect data on me.

We both know that there are companies out there that are trying their best to not exploit their users, and sadly these companies are often held to much higher standards. When a company that we trust, and trust enough to recommend to others who value their privacy, it does hurt when a company goes in the opposite direction with your privacy even when they have noble intentions at heart.

It's also completely telling when their engineers are standing up for their users and others at the company are trying to find any excuse to collect certain information for reasons.

Now, I'm never for personal attacks on someone no matter what, but I find it hard to call out people for using a widely used and available emoji. I do agree it's very much on the line and others might take the other opinion in this case.

hsiehwnb4• 7 years ago

It is not just nasty to customers.

It is public evidence of commitment to an illegal policy after the CFO was informed of the legal problems.

Not sure how you can do something worse.

dsissitka• 7 years ago

Here's a screenshot for people that don't feel like waiting for the page to load:

https://imgur.com/a/uxaU0h8

How is GitLab still this slow?

badrequest• 7 years ago

It's a Rails app trying to load hundreds of different bits of data (emojis, comments, votes on comments, etc.), I'd honestly be more surprised if it were quick.

dijit• 7 years ago

It’s probably hammering the database right now.

These kind of things, by nature, are difficult to cache because the balance between “fresh” new content and how often they are accessed leans heavily towards having it served from the backend directly.

swagonomixxx• 7 years ago

Ruby on Rails backend, I think.

colechristensen• 7 years ago

What?

I don’t understand. This should not be an opt in or an opt out. It is a condition of using our product. There is an acceptance of terms and the use of this data should be included in that.

In what way is that "nasty"?

sigzero• 7 years ago

It's "clueless" but not "nasty".

250R• 7 years ago

looks like CFO actual need is the historical data for LTV calculations https://gitlab.com/gitlab-org/gitlab/issues/13297

swoongoonz• 7 years ago

remember when everyone was bailing on github because of evil microsoft?

rvz• 7 years ago

Most of everyone's main reason was that GitLab was "open source" and also supports free software. As much as they claim to do, I'm afraid that by being partially owned by VCs, they are at the mercy of pleasing those who may conflict with these ideas in favour of adware such a telemetry or ad-tracking.

A very principled move from GitLab to revert this, but I think that GitLab's trusted is damaged due to this.

nessunodoro• 7 years ago

I think it will bring them under more scrutiny and rightfully so. But this sounds like a misunderstanding, both of the GDPR and user sentiment, enforced without discussion from the top. They responded quickly, humbly, and transparently in reversing the decision. I'm not sure about long-term erosion of trust, although this may harm subscription levels or contract negotiation in the medium term

peruvian• 7 years ago

The lesson to learn is that you can't trust VC-backed companies to have the same values or behavior through the years.

donarb• 7 years ago

Gitlab has also committed to doing a post-mortem on this, just as they do for crashes or data breaches, which is a good thing.

jbk• 7 years ago

We received an apology email at the same time, well written, explaining what they did wrong, apologizing, promising to do a post-mortem, promising to not send to 3rd party trackers, and saying they did a mistake and waiting for feedbacks on the issue tracker. And with very little BS in the mail.

Such level of transparency, of apologizing and clarity, especially written at the first person "I am truly sorry." is very rare and should be praised.

stiray• 7 years ago

What should really be praised... Without further, congratulations to everyone protesting against this gitlab move. This is something that should be done years back when google started with its tracking, same with facebook. This was the behaviour that should be seen each and every time some company wants to take advantage of its users. But to my sadness it is rarely seen. So once again congratulations to each and every gitlab user that did anything against their move.

brlewis• 7 years ago

Yeah, people back then should have written angry replies to Google's and Facebook's advance warnings about the tracking they were planning on doing. /s

tjoff• 7 years ago

It was done. There even was those small banners that said something in the way of "if you have gmail I won't mail you" etc.

Thing is, the broader public don't care. The difference between gitlab and gmail is primarily that developers care more about this stuff and value their code more than most people care about their email. They are also much more informed in the matter, most using gmail haven't got a clue.

imglorp• 7 years ago

It's a tiny SaaS that depends on customer good will. A few hundred pings did the job because we matter.

If only this worked with giant corps. FB has around 2.4 billion MAU and a few nerd rants won't be noticed the next time they screw the user and a handful complain.

matz15• 7 years ago

If you want to ban tracking, I would totally oppose it. I think its great that google manage to make money out of my personal data, and in return I get to use their of free service. Fortunately, in the regards of google user, there are more people who are fine (or don't care) with tracking.

tomnipotent• 7 years ago

same with facebook

There was a huge uproar when Facebook first launched "Beacon", and it was cancelled as a result.

Unfortunately it just morphed into the Facebook Platform and eventually the Pixel. Same pig with different lipstick.

piokoch• 7 years ago

Frankly I can understand that ads selling company like Google wants to track its users. Their core business depends on that.

Why Gitlab wanted to do this I have no idea, sounds like some marketing people came up with such idea "because everyone is doing this"?

Tracking wasn't going to bring much revenue, if any, so they could just get rid of that, trying to turn it into some positive PR. The cynic in me tells me that if they smell any significant money from tracking they would tell HN and the rest to back off (or would added some convoluted way to opt-out from tracking).

ageofwant• 7 years ago

What concerns me is how it got to the point of having to apologize in the first place. It implies a level of disconnect and and corporate group-think that is fundamentally misaligned with core customer expectation of what is in essence a community enabling system. How did Gitlab end up with a set of managers that ever thought this would fly ? They clearly were completely surprised by their customer's reaction - something that almost any of Gitlab' users would have understood viscerally.

This level of management disconnect does not bode well for Gitlab, as a paying customer this worries me...

TeMPOraL13• 7 years ago

Still, it's worth something that they reversed course and apologized, where so many companies wouldn't do either.

Madeindjs• 7 years ago

You can read email content on this issue https://gitlab.com/gitlab-com/www-gitlab-com/issues/5672

cryptonector• 7 years ago

Nice! An apology apology! Way to go GitLab!

scotth3• 7 years ago

Yes. Wonderful. More like this!

saithir• 7 years ago

No, there's nothing to praise here.

When I delete all my repositories by hand, one by one, I expect to not find a joke in that email about how "this email is sent to you because you have an active repository on Gitlab".

When I delete an account on Gitlab I expect to be deleted from all further mailings (especially ones I never subscribed separately to), yet I got this email today. How many more places do I have to delete my information from to finally be rid of Gitlab?

How many more third-party companies Gitlab shared my data with at this point? Because that they do have it, there's no question about it - after all I just got this email.

emilycook• 7 years ago

Hi GitLab employee, we used the same mailing list as the one we used for the first email, so that's why you still received it. If you deleted your account you won't get any future emails.

xxs5• 7 years ago

Given that any default opt-out is a clear violation of GDPR when it comes to data gathering, I wonder how it ever passed compliance/legal. Given the size of the company (valued ~ $3b) they should have some 'data protection officer' position.

I recall they setup some blog page with explanations, so obviously they expected push back. Part of my work is making sure policies, code, etc. are compliant. Notifying compliance for such changes should be a standard procedure as well. In this regard I can't understand how the entire process went through, as GDPR challenge should have been expected.

red_admiral5• 7 years ago

There is a comment on the issue tracker alleging that the CFO overrode concerns by the Director of Global Risk and Compliance.

red_admiral5• 7 years ago

Saying "I'm sorry" when you don't have to is worth praise. Saying it when your back is to the wall and your job is on the line - even cowards can do that.

I agree it's one of the best-written apologies I've heard in a while, and they deserve some praise for not letting the corporate ~bullshit~ PR department run loose all over it.

But still. I suggest that whoever is responsible should resign as a result of this Pendogate business. I feel that he has betrayed users' trust in a way where an apology alone is not sufficient. I personally consider the original plan - we'll lock you out of your accounts and disable the API until you accept our new TOS, if you don't like it there's the door - far worse than anything Brendan Eich ever did, for example. I don't want people who ever think that could be an acceptable idea in charge of a company I rely on day-to-day.

Replacing him would be a very strong signal from Gitlab's board that they are truly sorry and understand the severity of this scandal, and would also encourage future CFOs to take their users' views more seriously.

It is pathetic in a way that while lots of people were worried that Microsoft would "corporatise" github, it's gitlab that decided it was ok to threaten to lock people out from their accounts until they "consented" to this.

_EDIT: Paul Machle is CFO, Sid Sijbrandij is CEO and the person who sent the apology. I have removed names from the original post as I am not sure which of them signed off the original idea. I expect a CEO to take the attitude "the buck stops with me" though - they should be accountable even if they're not directly responsible._

falcor843• 7 years ago

Could someone here please explain to me why Gitlab's product managers would be so interested in client-side analytics in the first place? From my familiarity with their service, almost every operation requires an ajax call, or a full page refresh. Is there really that much value for the product managers in these additional analytics?

afiori• 7 years ago

I believe in this case it is server-size analytics. The case were this would have been significan would have been with self-hosted instances as there gitlab controls neither the servers not the clients

robszumski• 7 years ago

Even anonymous cohort analysis can be super useful as a product manager. If you want to encourage usage of a particular feature and the most successful users of that feature fit into a cohort, you can reach out to them for feedback, optimize paths between those features, improve documentation connecting relevant features together, etc.

This doesn't mean its malicious or all about the $$$...it might be that users that set up GitLab CI have 40% fewer security incidents and they want to encourage that behavior as a better customer outcome with the overall product.

edit: and this behavior might take place over a long period of time, not something you can get from access logs or just-in-time stats.

falcor843• 7 years ago

That's an interesting point. But wouldn't the vast majority of Gitlab users be signed in (and thus server-side trackable)? Pretty much all functionality other than just reading code seems to require it.

sjburt• 7 years ago

My guess was that it was just seen as easier to drop in a third party analytics component in as opposed to doing via their own backend.

itronitron• 7 years ago

years ago, at a previous employer of mine, one of the IT staff members was giving a presentation on an internal website/app they created for some widely used business function (i don't recall exactly) and they were rather proud of the fact that they tied in Google Analytics so that they could get a better view on how people were using the site.

I expect that a lot of other companies are also doing this to themselves...

function_seven• 7 years ago

Wasn't this proposal to add the client-side tracking to their hosted on-premises product?

They don't have any visibility in how those instances are being used, and wanted to use the telemetry to get that. (Not understanding that often, the entire point of choosing to host your own instance is to avoid this in the first place)

EpicEng6• 7 years ago

No, it was for everyone. They initially conceded not to add it to their enterprise versions (post-backlash), but the intent was always to add it for the rest of us.

Sir_Cmpwn3• 7 years ago

I don't understand, what changed? This was last updated on the 24th. They said they'll be re-evaluating it and returning later, but afaict they haven't made any statements about a blanket cancellation of the telemetry roll-out.

lbotos• 7 years ago

An email is being sent right now, but emailing at scale... takes time:

---8<---

Dear GitLab users and customers,

On October 23, we sent an email entitled “Important Updates to our Terms of Service and Telemetry Services” announcing upcoming changes. Based on considerable feedback from our customers, users, and the broader community, we reversed course the next day and removed those changes before they went into effect. Further, GitLab will commit to not implementing telemetry in our products that sends usage data to a third-party product analytics service. This clearly struck a nerve with our community and I apologize for this mistake.

So, what happened? In an effort to improve our user experience, we decided to implement user behavior tracking with both first and third-party technology. Clearly, our evaluation and communication processes for rolling out a change like this were lacking and we need to improve those processes. But that’s not the main thing we did wrong.

Our main mistake was that we did not live up to our own core value of collaboration by including our users, contributors, and customers in the strategy discussion and, for that, I am truly sorry. It shouldn’t have surprised us that you have strong feelings about opt-in/opt-out decisions, first versus third-party tracking, data protection, security, deployment flexibility and many other topics, and we should have listened first.

So, where do we go from here? The first step is a retrospective that is happening on October 29 to document what went wrong. We are reaching out to customers who expressed concerns and collecting feedback from users and the wider community. We will put together a new proposal for improving the user experience and share it for feedback. We made a mistake by not collaborating, so now we will take as much time as needed to make sure we get this right. You can be part of the collaboration by posting comments in this issue: https://gitlab.com/gitlab-com/www-gitlab-com/issues/5672 If you are a customer, you may also reach out to your GitLab representative if you have additional feedback.

I am glad you hold GitLab to a higher standard. If we are going to be transparent and collaborative, we need to do it consistently and learn from our mistakes.

Sincerely, Sid Sijbrandij Co-Founder and CEO GitLab

Sir_Cmpwn3• 7 years ago

Thanks! That context is sorely needed in their web channels.

igreulich• 7 years ago

I don't see where it is canceled. The closest thing I see to canceled, is postponed.

From the update: 'We will not activate user level product usage tracking on GitLab.com or GitLab self-managed before we address the feedback and re-evaluate our plan.'

That leaves a lot of wiggle room.

epoch_100• 7 years ago

"Further, GitLab will commit to not implementing telemetry in our products that sends usage data to a third-party product analytics service."

That seems like a pretty solid indication that the plans are cancelled.

itake• 7 years ago

That sounds like they are going to roll out a first-party service, which is better, but not great for the self-hosted deployments.

SlowRobotAhead• 7 years ago

No 1/2 decent CEO, PR, Legal or any other department at work here would leave themselves without wiggle room.

I’ll reserve the pitchforks for if this comes up again.

hanniabu• 7 years ago

Yup, and it's not that they plan to backtrack, it's to reserve room for not committing to an exact outcome, but instead a general outcome. What they plan to do is not necessarily what will happen exactly, as anybody that has been in a position of authority or part of a project knows. Things may take a little longer, there may be some detours, etc. It's insurance so somebody doesn't armchair nitpick and shame them.

bigiain6• 7 years ago

I think there's compelling evidence that there is not a "1/2 decent" CFO at work there...

I'm gonna keep my pitchfork sharp, close, and on display here.

mobee• 7 years ago

The real reason you shouldn't be using GitLab is performance. How is it possible that that page took over a minute to load? Nevermind that the design is completely incomprehensible.

catalogia2• 7 years ago

I make a habit out of pushing to both gitlab and github. Even if github is technically superior, I don't think we're served well in the long run by monocultures.

(But yes, gitlab's web interfaces are generally frustrating. Slow, bugged, or just organized in ways I find challenging.)

swasheck2• 7 years ago

further down the thread are mentioned of ruby on rails.

i use gitlab because it allows me > 1 private repo. if there are better solutions then i'm all ears.

smudgymcscmudge• 7 years ago

Have a look at GitHub. It's a similar service with unlimited private repos for free.

davidclark22• 7 years ago

I use Bitbucket, unlimited private repos. I believe Github now offers the same, but didn't ~5 years ago.

JohnFen• 7 years ago

Performance and UI are valid considerations for using or not using any service, but not everyone has the same requirements on either of those.

If you don't find them acceptable, that's legit. Those are the "real reasons" you shouldn't use it. However, those reasons may not apply to others. They don't apply to me, for instance, and as Gitlab has a lot of users, I'm not alone.

tyre• 7 years ago

The reaction to this whole saga has been insane. Chill out people.

They fucked up, users gave feedback, they listened.

This isn't some corporate conspiracy, some grand ethical dilemma with an evil company on one side and some white knight hackers on the other.

Let's imagine for a second that they are people trying to do the right thing, with years of history doing the best they can.

They wanted to measure usage to make their product better. People seem to disagree, which, okay, but the outrage here is everything wrong with the internet.

Operyl• 7 years ago

I think what sparked a bit more outcry in this matter is the way the CFO responded to discussion and early warnings way before it was finalized.

EDIT: https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#no...

cwkoss• 7 years ago

Bit surprised that Paul Machle is still employed as CFO.

xiphias24• 7 years ago

They wanted to violate my rights given by Article 7.2 of the General Data Protection Regulation (GDPR), this is clearly making the product worse.

What's great with GitLab compared to other companies is that they are doing things in the open, while another company would just violate my rights without me knowing it.

If you go through the comments, multiple (toxic) people in GitLab doesn't care about user rights, just want to push the change as soon as possible (just like in any other company that I have been working in).

It's also clear that you get VP/Director/Staff engineer by just pushing through other people (sadly I have seen the same thing happening other times as well).

SamReidHughes8• 7 years ago

You can opt out by not using it, right? They'd be supposed to drop EU users, under some interpretation of the law. But even if they didn't, then as an EU user, you'd still be able to protect your own rights by ceasing use of their services.

hn_throwaway_99• 7 years ago

The reaction to this whole saga has been insane. Chill out people.

I very much disagree. I think the outcry was warranted, and right now I see GitLab doing the right thing (and, obviously, the outcry was a huge reason for that).

Changing plans in the harsh light of public condemnation isn't easy, and for that I very much commend GitLab. As someone who was very much against the previously announced change, though ( https://news.ycombinator.com/item?id=21350146 ), I'm glad the community feedback was so strong.

prophesi• 7 years ago

Yeah, if the outcry continued even after their rollback & apology, _then_ it would be unwarranted. But everyone's happy now (well, arguably GitLab may not be, but they should surely be able to work out a solution with the community on how to collect telemetrics in a privacy-conscious way).

I'm also glad the feedback was so strong, as the ad-tech industry has spent the past 15 years numbing the general populace to unwarranted (and often unnecessary) telemetrics.

It's understandable that GitLab had no ill-intentions. But how can one know whether third-parties share such sentiments?

Vinnl• 7 years ago

It doesn't seem to me that GP disagrees with that. They're not telling people to chill out in the sense that they should have voiced their concerns about the feature; it's about the outcry, about the black-and-white, evil-vs-good type of discourse that was happening in response to it.

elliekelly• 7 years ago

Let's imagine for a second that they are people trying to do the right thing, with years of history doing the best they can.

When I first saw they had their compliance policy repos set to public so anyone could view internal discussions around changes the lawyer in me just about fell off my chair. That is an almost unbelievable level of transparency. It's difficult for me to assume anything but the best intentions when GitLab has gone out of their way to let people see how the sausage is made.

acrispino• 7 years ago

How do we know that they would have changed their plans without the outrage?

EpicEng6• 7 years ago

They wouldn't have. many devs were against it internally, but they went forward anyway with the opt-out scheme. Why would they go through all that, announce the feature, and then just decide to cancel it?

Accacin2• 7 years ago

Let's imagine for a second that they are people trying to do the right thing, with years of history doing the best they can.

How could a company like this ever think that opt-out is appropriate? It seems like all their engineers knew this was a bad idea and everyone else seemed to think it was okay!

The problem for me was how a company like this couldn't see that this would happen and went along with it, I held Gitlab to a high standard and honestly I've lost a lot of trust with them.

I'm thankful for the outrage, and whilst I will never condemn personal attacks, I feel discussing the matter on places like HN was appropriate.

EpicEng6• 7 years ago

Not to mention the fact that the CFO didn't want to even allow opt-out under any circumstances.

EpicEng6• 7 years ago

Their CFO showed that he has little regard for the privacy of their users. I highly doubt that has changed. Many devs and compliance folk were on the right side of this in the MR and feature threads, but they were overruled.

I highly doubt the CFO has changed his viewpoint, and he's still in power over there. They only backtracked after the "insane" reaction. They anticipated some amount of pushback, but obviously hoped it would be smaller and they could move forward.

SamReidHughes8• 7 years ago

Privacy? Their users are companies building software. The CFO is right -- they can agree or disagree to the terms of use and choose whether or not to use the new software.

jacquesm2• 7 years ago

The CFO is not in charge.

stefan_• 7 years ago

Uhm, they sent a mail saying "we're locking all access to your project data until you accept our new ToS, or fuck off".

It doesn't take a genius to realize the mistake here.

overgard2• 7 years ago

If there hadn't been an outcry gitlab wouldn't have changed their trajectory. Seems like it worked.

bogomipz• 7 years ago

"The reaction to this whole saga has been insane. Chill out people."

No, it hasn't unless a civil discussion in an area where people have strong opinions is somehow your definition of "insane."

"People seem to disagree, which, okay, but the outrage here is everything wrong with the internet."

There is no "outrage" here just lots of concern if not some well-placed bewilderment at a particular brusque comment made by their CFO on the issue[1]

The great irony is that you have dismissed and self-proclaimed that an entire civilized and adult discussion as "outrage culture" and "everything wrong with the internet."

[1] https://gitlab.com/gitlab-org/gitlab/merge_requests/14182#no...

thsowers• 7 years ago

Is this supposed to read "misunderstands"? And if not, could you elaborate?

Sir_Cmpwn3• 7 years ago

Yes, it was. Thanks, I edited it.

buremba• 7 years ago

We sent an MR to Gitlab 1.5 years ago (https://gitlab.com/gitlab-org/gitlab-foss/merge_requests/156...) implementing our open-source analytics tool to their app and letting the system administrators opt-in to this feature if they want to analyze their user behavior but it looks like Gitlab wanted to implement a centralized user tracking feature for themselves instead.

However, given that most of the Gitlab customers / open-source community cares about their privacy and want to have the control (well, that's probably why they switched to Gitlab from other products), I wonder why they wanted to follow this approach in the first place. The good thing is that they almost always know how to take action when their community reacts.

akerro• 7 years ago

I'm happy to enable telemetry on my self-hosted Gitlab if that makes gitlab better, maybe make it opt-in instead opt-out?

foreign-inc• 7 years ago

How can you trust a company like GitLab whose default decision is always bad and then they change direction after public outcry.

Either they don't think before they make decisions or they are just trying to figure out what they can get away with.

This really shows their lack of morality. They kind of remind me of Facebook.

xiphias24• 7 years ago

How can you trust a company that does the same things behind closed doors?

With GitLab we know about everything that's happening and can react before bad things happen. This is awesome.

techntoke2• 7 years ago

Lol, I think you're forgetting about another provider. Besides you can always try Gitea.

flukus3• 7 years ago

Is the on premise one different? The hosted one leaks data to google and cloudflare.

musicale2• 7 years ago

It shouldn’t have surprised us that you have strong feelings about opt-in/opt-out decisions

Well yes, it should be obvious by now that requiring users to opt out to avoid some privacy-violating behavior is a facebook-class dark pattern.

notJim4• 7 years ago

I find the anti-telemetry attitude honestly kind of confusing. I mean, you know that the shops you go to know what products you're buying from them, right? Presumably those shops look at that data in aggregate when thinking about which products to stock. How is this any different? If you're transacting with someone, it's not possible to hide that transaction from them. Of course you should have the right to have that data deleted, but that's different from saying it should never be collected at all.

Also, given that nearly all websites are using something like Google Analytics or similar (or several of these at once), the reaction and vitriol here just seems weirdly disproportionate.

mkl• 7 years ago

Web tracking is different in that it's ongoing tracking of behaviour. When I buy something from a shop, that's the end of their knowledge: the shop has no idea what I use it for.

notJim4• 7 years ago

Hmm, that must be where the breakdown is. It seems like you view just the transaction as your interaction with Gitlab, but to me if I'm on Gitlab, I'm still "in the shop" so to speak. So to me it's more like sitting in a coffee shop than going to the grocery store.

kevin_thibedeau• 7 years ago

When you make non-cash purchases in a shop they sell your purchase data to an aggregator who adds it into their profile of you and derives demographic classifications from that.

Single woman driving a Subaru? Your odds of being lesbian go up a few points. We'll target you for a certain form of advertising.

This has been going on for decades. Before the web ever existed.

d357r0y3r• 7 years ago

Of course you should have the right to have that data deleted, but that's different from saying it should never be collected at all.

Err...do you have that right? The whole concept of a "right to be forgotten" is a relatively new thing that generally has not been observed in the past.

Like, if I want the library to erase all records of me checking out books, they probably just aren't going to do it, and I don't see how I have a right to force them to. I willingly gave them my information and used the books there.

samsari2• 7 years ago

Err...do you have that right?

In the EU, yes you do.

Like, if I want the library to erase all records of me checking out books, they probably just aren't going to do it, and I don't see how I have a right to force them to.

They will. You do.

I willingly gave them my information and used the books there.

And then you changed your mind.

stonogo• 7 years ago

I mean, you know that the shops you go to know what products you're buying from them, right?

They know what products are selling. They don't necessarily know what I personally am buying.

The point of those loyalty program cards is to associate purchasing habits with repeat customers. Those cards, you may note, are opt-in. To belabor the analogy, this was the equivalent of my grocery store putting cameras all over the building and offering me a mask if I wanted to opt out of the user monitoring program.

"Everyone else is doing it" is a pretty bad reason when many of your clients chose to do business with you at least in part because you are not doing it.

notJim4• 7 years ago

They know what products are selling. They don't necessarily know what I personally am buying.

The vast majority of people use credit cards, which would allow them to track you. If you want to be more anonymous, you can use cash, just like you could install a blocker extension if you want to be more anonymous in the browser.

To belabor the analogy, this was the equivalent of my grocery store putting cameras all over the building and offering me a mask if I wanted to opt out of the user monitoring program.

Indeed, my local grocery store added cameras all over recently, and apparently many of them use bluetooth trackers. I don't even think they offer masks, though I've never asked.

"Everyone else is doing it" is a pretty bad reason when many of your clients chose to do business with you at least in part because you are not doing it.

Did gitlab pitch themselves as a privacy-centric git host? I thought their main selling point used to be that they had unlimited private repos. I could be wrong though, I haven't followed them much.

TeMPOraL13• 7 years ago

I'm hostile towards both on-line and meatspace telemetry alike. It's just it's much harder to opt out from the latter. When a store I frequent decides to be total assholes and install customer-tracking cameras, I can't even tell (and unfortunately, there's no legal requirement to inform about it; I hope it'll change in the future). And even if I could, like most people, I'm rather price-sensitive when bulk shopping. On-line, I can at least try to defeat most telemetry with content blockers and network filters.

Of course you should have the right to have that data deleted, but that's different from saying it should never be collected at all.

Anything that GDPR forces to be opt-in (like this telemetry here) is essentially data that shouldn't be collected in the first place.

Also, given that nearly all websites are using something like Google Analytics or similar (or several of these at once), the reaction and vitriol here just seems weirdly disproportionate.

There were couple compounding issues here, not the least of which was them wanting to deploy telemetry on self-hosted instances. On Gitlab.com, they can deploy analytics scripts to their heart's content; that's just being disrespectful. But self-hosting is something one does in big part to control the data flow, and pushing telemetry onto that kind of defeats the point (it's a real compliance issue for a lot of companies).

As others have said, just because many other people do something, doesn't mean it's good and you should do it too.

andrewbinstock• 7 years ago

We have not yet added instrumentation to the Enterprise edition versions, and we will not do so until we have a way for self-hosted customers to opt out... (Scott Williamson, Gitlab VP of product, responding to the OP)

That's not the right way to do it. Customers should need to opt in, rather than having to opt out.

segmondy• 7 years ago

This is just the beginning, at some point, they will flip. Google was our darling, that could do no wrong. Just imagine, to be bold and say "Don't be evil!" And then, what happened? This is just a short term reaction to quiet down the noise, but their long term hand has been exposed. They are not going to do it, but note that nothing says they won't try to or do it again in the far future.

What I really will like to know is how they will profit off that data. Is it even going to make a bump on their bottom line?

mav3rick3• 7 years ago

What happened ? Google is still one of the better players around. They pulled out of DoD contracts etc. This site just hates it for every single thing..it's just group think now , majority of the general public still loves it.

pferde• 7 years ago

Majority of the general public does definitely not love, nor hate Google. They are merely indifferent and tolerate it, just like they tolerate Microsoft, or more recently Facebook, despite all the flaws and annoyances their products have.

The general public does not really care, they just want to get on with their lives.

akhilcacharya2• 7 years ago

They trust lots of other companies more, including Amazon

http://nymag.com/intelligencer/2018/10/americans-cant-agree-...

PacifyFish• 7 years ago

Maybe I've missed the boat, but what's the big deal about collecting telemetry?

You already trust Gitlab with everything you store in Gitlab, like source code, which is presumably much more sensitive than the number of times you loaded a page or clicked on a button or whatever.

Is it because the data would be stored with a third party, and you don't trust that third party? If Gitlab trusts the third party, and they're giving you the option to NOT trust the third party and only trust Gitlab, what's the issue?

sleepytimetea2• 7 years ago

"in Gitlab" has 2 meanings - Gitlab cloud and Gitlab on-premises. For customers running off-the-grid or in countries with enhanced privacy (GPDR?) laws and restrictions on where their data lives, this is not what they signed up for. Nor was the timeline forced on them reasonable in any way. Imagine your Oracle software TOS says we will now export anonymized data from your SQL queries to somewhere out there in the cloud ? What if it was a HIPAA-compliant hospital datacenter ?

We wouldn't want first-party telemetry either, we don't want _any_ data leaving our datacenter, period.

btashton• 7 years ago

Something a little ironic about putting a tracked click link in an email apologizing for adding tracking. That said I firmly believe in opt-in tracking and would likely enable it for my gitlab usage.

dreamcompiler• 7 years ago

I'm glad they reversed course and apologized but it still amazes me how powerful the reality distortion bubble can be even at well-meaning corporations. It's as if there was a meeting at the Red Cross where somebody said "Hey why don't we start selling guns? It would be a great fundraising tool." And everybody in the room just nodded and said "Yeah that's a pretty great idea. Let's start tomorrow!"

jamiequint7• 7 years ago

This is incredibly dumb. Both Pendo and Snowplow are analytics providers, meaning they both have in their TOS that the company remains the owner of the data in question and that the services only exist to facilitate analysis of the data in question.

Effectively this is users complaining that Gitlab wants to simplify their data analysis overhead. Presumably nothing precludes them from sending the exact same data to these companies and more on the backend. What do users expect? For Gitlab to build every single part of their stack in-house (CRM, analytics, support tooling, etc)? Because that's what this is effectively asking for.

What's next? Protesting that a company uses RDS instead of their own hand-rolled Postgres setup? Because this is the same level of stupid.

mobjack• 7 years ago

There is a lot of FUD whenever someone mentioned third party because many don't know the difference between a dedicated analytics provider and Facebook.

TeMPOraL13• 7 years ago

How would you know a difference, how could you trust the difference (given the adtech industry being what it is), and how can you know things won't change over time? All that without being in a contractual relationship with that third party.

orf4• 7 years ago

I think part of the issue was that there are many cases where you can't send potentially sensitive information to a third party, regardless of their TOS.

I left a comment on the feedback issue about this. It's not as comprehensive as a third party, but you can build your own analytics in house. There are a lot of managed services (like BigQuery) that make it significantly easier to implement it yourself, and you do get valuable insights from such data.

jamiequint7• 7 years ago

I think part of the issue was that there are many cases where you can't send potentially sensitive information to a third party, regardless of their TOS.

I don’t think this is true, provided the third-party is GDPR compliant themselves. It’s the controller-processor relationship under GDPR. Presumably if there was not a cutout for this, AWS would not be able to exist.

flukus3• 7 years ago

The main issue was that this is for internally hosted enterprise instances, so no they can't just pass along the same data on the backend because they don't control the environment the backend is running in.

In the hosted gitlab, if they want to keep me as a paying customer they should be looking at on premise analytics providers. If there going to be sending data out to random third parties I don't trust, who I can't trust because I have never heard of them and have no relationship with, then I can't trust gitlab either.

jackcodes• 7 years ago

What about running third party scripts on the page, which would have access to all code on the account you’re logged in with? How do organisations audit these scripts, and how can they audit new versions of these scripts when gitlab controls the release strategy of these scripts?

You’d be moving from one (possibly two if you include the cloud provider) vendors having theoretical access to all of your code to four vendors having potential access.

jamiequint7• 7 years ago

Any vendor Gitlab works with already has potential access. Just because you have a known front-end attack vector doesn’t mean you’ve gone from 1 to 4. You’ve been at N the whole time, it just hasn’t been as visible.

FWIW I agree that on-page JS on pages with source code is a terrible idea, but that’s easily fixable and doesn’t seem to be at the root of the issue.

OrgNet• 7 years ago

how did they get caught?

TeMPOraL13• 7 years ago

They self-pwnd themselves. They posted a blog post saying that starting very soon, everyone will be getting third-party telemetry, self-hosted instances included.

AdrienLemaire• 7 years ago

Great attitude. Interesting correlation with the episode S06E01 of Silicon Valley released this week, on the same topic :)

koalaman• 7 years ago

How is this different from the telemetry that VS Code is collecting? The "community" seems to have swallowed that pill with much less complaining.

account422• 7 years ago

Is that the same community that is complaining now?

omani• 7 years ago

it still boggles my mind how one can use gitlab.

gorkemcetin• 7 years ago

Long story short, if Gitlab were to use a open source & self hosted platform (like Countly) with a clear mentioning of what to collect and what not, clarifying that nothing is collected which is not anything unknown to them, there would be no problems. Gitlab CEO has provided the right response with the right tone, which is something we don't usually see in big corps. I again would like to stress that such platforms not use 3rd party analytics providers but a self hosted and/or in-house solution.

sacrificedcapon• 7 years ago

Is it possible to enforce american spelling ( especially in the title )? Behavior vs Behaviour?

HN is an american company and gitlab is an american company so people who participate here should use correct american spelling.

The gitlab post itself uses the correct spelling - behavior.

"In an effort to improve our user experience, we decided to implement user behavior tracking with both first and third-party technology"

samsari2• 7 years ago

So if the subject on the story was a Swedish company you'd presumably be up here arguing that people who participate should use the correct Swedish spelling?

techntoke2• 7 years ago

This just tells me that someone needs to continue working on Gitea or another open source alternative so that you can easily self host something comparable to GitLab enterprise. Yes, GitLab has an open source CE version but it has limited functionality. If another open source solution can implement the same functionality as their enterprise product, then GitLab will be forced to adopt or risk losing their business. Time to put some pressure on them.

mbar84• 7 years ago

I'm normally one to hold a grudge. I still don't buy Sony products for something they did over a decade ago. In this case I think forgiveness is appropriate. There are obviously people working at Gitlab who have terrible ideas, but the organization seems to be able to deal with them in a healthy and transparent way. This compares favourably to companies like Zoom or Equifax.

Yuval_Halevi• 7 years ago

I'm impressed by the way Gitlab is communicating on a personal level with all of their users on email bombs.

ptah• 7 years ago

I think it would be more acceptable if they let users preview the data sent

tachion• 7 years ago

Well, I suppose that's The Gitlab Drama for this quarter. /s

je42• 7 years ago

If i compare this to StackOverflows communication, I like this way a lot more.

grumpy-cowboy• 7 years ago

If I pay for a product (on-premise), it's not your business what I do with it.

If I use the free hosted service (ex: gitlab.com), then this is the price to pay for a free service (within legal rules like GDPR).

BTW, it's too late for me. I'm about to move all my stuff to a self-hosted Gitea (on a cheap VPS) in addition to Matrix, Mastodon, ...

Gitlab cancels plan on tracking user behavior on GitLab.com

Related Stories