Hacker News Reader

> We have a lot of upset customers thinking that GitLab self-managed telemetry will be mandatory for Self-Managed GitLab moving forward

It may not be mandatory now but, by agreeing to the new Terms of Service, it can be mandatory at any time in the future without being notified/needing to agree to the change (since it's already in the ToS). This Slack conversation is just as short-sighted as the blog post.

I'm surprised the proposal to allow third-party scripts (something GitLab doesn't control!) to run on customer's closed environments made it out of a 30-minute meeting.

> I'm surprised the proposal to allow third-party scripts (something GitLab doesn't control!) to run on customer's closed environments made it out of a 30-minute meeting.

I've always been curious how this happens. How can a group of people who should know better just ignore or not realize the backlash that will come. There was not a single person who raised a red flag?

> I work at GitLab.

HN is a good opportunity to reach out, so I will use it: there's some kind of dark pattern employed during this Terms-Of-Service switch.

GitLab does not allow to login without accepting the new TOS, which means that I cannot remove my account without accepting the new TOS.

I didn't use gitlab that much anyway, but the TOS change just reminded me about the need to close the account... yet "you must accept the TOS to login" does not allow to remove the account. So, accepting the new TOS is kind of forced upon if you want to find your way out (in other words, it's made inconvenient and we-will-drag-our-feet otherwise).

Can someone take a look into it? I received two template-responses from email support, but no action.

My support request is 136340.

My email is in my profile. I can't find your ticket for some reason. I think the problem that you were experiencing was a bug, but we've rolled back the TOS Change so it might now become a non-issue.

Regardless, happy to clarify whatever I can.

A few hours after posting this I received another email, saying that per my request the account is being removed. I can see it removed now; I guess that's the reason the ticket is no longer there. Happy to see it resolved.

Just send a GDPR data delete request. Let the lawyers deal with it.

That only applies to EU residents.

That only applies to Personal Data. It doesn't close your account or delete your source code. etc.

Yeah, cannot they just do a soft delete or change a bool like disableAccount from false to true, for example? :D

I believe this is what Discord does. If you delete your account, or if you request it to be deleted, it does not delete your comments, your name changes, your profile photo gets removed, but the comments are still there. Are they not considered personal data? Call me paranoid, but I do not believe that your comments actually get deleted even when you delete them either, I would say they just get hidden.

Since GDPR topic was brought up, let me give some more details; GitLab seem to be well aware of GDPR.

This was initial response from GitLab to my request (let's call it Template1):

> We understand that you want to completely remove your GitLab.com account.

> Due to the complexity of servicing these requests, we're asking our users to

> please email gdpr-request at gitlab.com.

> Please ensure that you:

> - send the email from the address associated with your GitLab.com account

> - include the GitLab username you'd like removed

I did send an email to that address repeating my request, but shortly after I received this response (let's call it Template2):

> We have additional updates with regards to our TOS and Telemetry services

> below:

> We understand that the recent announcement regarding the update to our Terms of

> Service, specifically in regards to Telemetry, can lead to questions you have

> about how it impacts your usage of GitLab.

> To answer those questions and gather feedback on this recent update, we have

> created this Issue with additional clarification. As we firmly believe that

> everyone can contribute, we want to assure you all feedback you provide via the

> Issue is both welcome and appreciated.

> Kindly advise if you would still want us to proceed with this request.

I repeated my request, reaffirming that I want to remove and erase my account. In response, they sent "Template1" email again.

Edit:

to be fair, it's been less than 24 hours since the request, and the repeated template-response from GitLab may have been a hiccup on the support side.

But the whole new TOS switch could be handled much better and without dark patterns, i.e. during login, two buttons:

[Accept new TOS] [Decline and erase account]

However, right now there's simply no option to handle account removal conveniently when I want to decline the new TOS.

> In response, they sent "Template1" email again.

At this point I would simply wait the 30 days or whatever they have to respond and if they don't, complain to your data protection commissioner. They could get hit with a big fat fine for it, so its in their interest to make sure they respond correctly and don't send you around in circles.

> [Accept new TOS] [Decline and erase account]*

Actually, that's still a GDPR violation. A user cannot sign away their rights in the ToS. From https://gdpr-info.eu/art-7-gdpr/ "Conditions for consent":

If the data subject’s consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding. [..] When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.

In other words, if Gitlab ties the consent for telemetry together with access to the service itself, the consent is considered not freely given and therefore not legally binding at all.

> That will likely come in a second phase of the project, and we will figure out opt in/opt out for those scenarios before launching.

You might want to pass on that the current opt in/out scenario won't work everywhere either.

Safari 12.1 removed the DNT header[0] because it was only being used for fingerprinting.

https://developer.apple.com/documentation/safari_release_not...

>Safari 12.1 removed the DNT header[0] because it was only being used for fingerprinting.

In retrospect, it's hard to imagine this working out any other way.

The fact that Gitlab didn't include information about enterprise having opt-out ASAP shows how out of touch Gitlab is with (or how little they care about) enterprise customers. Or does Gitlab just not have enough Enterprise customers to care about?

> 5d Scott Williamson We are not adding Pendo or Snowplow JS snippets to self hosted versions yet. That will likely come in a second phase of the project

Can it come in an ∞th phase instead?

I am not sure it is a good idea to post internal slack conversations to a thread like this on HN.

I asked Scott, VP of Product, if he was okay with it. He was. In earnest, it should have been on an issue, so I could have linked to it directly.

Curious to know what planet you guys live on that you think you could put non-opt-in 3rd party telemetry on enterprise-level software and not get this kind of feedback.

https://gitlab.com/gitlab-org/gitlab/commit/bd6e6180e61916ed...