Hacker News Reader

Comment by emilycook | Hacker News Reader

Hello! GitLab employee, I understand the frustration however self-hosted customers on EE will not be affected. We opened an issue here to help clarify: https://gitlab.com/gitlab-org/growth/product/issues/164

View on HN

To clarify your clarification, a quote from that issue:

> We are not adding Pendo or Snowplow JS snippets to self-hosted versions at this time. We are carefully considering the appropriate opt-out functionality for telemetry that will work best for our customers, and we will clearly communicate to those customers when any change is made.

In other words, it's not that self-hosted will not be affected, it's that self-hosted will not be affected yet. That's an important distinction.

Never trust private companies to not screw you out.

Small companies are generally more trustworthy, until they come to a position of dominance, where they are just there to squeeze.

Also, why is it opt-out and not opt-in?

That's a trend going for years.

A lot of services, newsletters, promo, telemetry, are by default opt-out. When you install some chat app, it also syncs some data (e.g. contacts maybe?) and then you can go in the settings and opt-out for that sync..

because with opt-out they can first gather the data and keep it before you can opt-out.

I'm guessing because opt in doesn't generate enough useful results while opt out does.

Let's be real here, the difference between opt out and in is probably several orders of magnitude worth of data. It's like, would you rather have a Megabyte of telemetry to analyze or a Gigabyte?

Except it does, if you have a sufficiently convincing reason for people to opt-in.

Since a few weeks, our hackerspace - which used to publish all door unlocks on IRC with the nickname of the person unlocking it, by default - requires opt-in for nicknames to be published.

People recognize that this is an important social function of the space, because it ties together the IRC channel and the physical space, and thus the vast majority(!) of members have explicitly opted in.

This whole narrative that "if you make it opt-in, not enough people would ever do it" always conveniently leaves out that that's only true for things where people don't want to opt in, ie. usually things that benefit the service but not the users.

Right, which is why GitLab in this case wants opt out since their reason for collecting telemetry isn't particularly compelling

Opt-out (ideally opt-in) is very important for enterprise customers, especially self-hosted.

Our enterprise security people would complain about data exfiltration risk. GitLab would only survive if the security people approve it & that is a LOT of extra work for the internal team that keeps GitLab sold within the company.

Wow the blog host reads poorly then, when I read “self-managed” I assumed managed by the customer, not Hosted Gitlab. You might want to clarify that in the post..

We're testing this out on .com to see what value it really gives us and how it works, and depending on that then we might roll this out to EE. HOWEVER any move to do so will be properly communicated, and we're not going to implement it without carefully considering an appropriate opt-out strategy.

Yeesh. You guys just went from restoring my faith a bit a few months ago to this possibility? I’m sorry, but please get a grip here, it’s tiring being on this rollercoaster.

as long as it is out-out, instead of opt-in, it probably won't fly with any corporation.

edit: was trying to make a joke, it was a bad joke

As a disclaimer, I do not believe I've ever seen a captcha when logging in to GitLab. But according to https://docs.gitlab.com/ee/integration/recaptcha.html, you use reCAPTCHA?

Are you aware of the privacy concerns surrounding reCAPTCHA? https://en.wikipedia.org/wiki/ReCAPTCHA#Criticism

I was just trying to make a joke I'm so sorry. As for recaptcha we have an issue here with a ton of discussion around it that links quite a few more if you're interested: https://gitlab.com/gitlab-org/gitlab-foss/issues/46548

Quite a bit of discussion on a year old issue but.. its still not resolved? That doesn't instill confidence.

What..?

I'm so sorry I was trying to make a joke, it's been a long day as the messenger trying to relay everyone's concerns about this back to our team.

I said "What..?" not because I didn't recognize the joke, but because nowhere did I bring up "security/privacy." My initial comment was stating that the blog post should clarify that these changes were not coming to EE immediately, because I (along with many others here) seem to have read it in such a way that it sounded like it was.

I hope I covered that in my other comment

That clarification should explicitly address the original email that contradicted it (eg self managed EE would be getting telemetry).

That does not mention anything about if I still have to agree to the new terms and conditions or not. Contrary to what you seem to think "at this time" is not very reassuring for me as a paying user.

I'm confused. Are you a Gitlab employee or are you addressing a Gitlab employee? Edit: From the parent commenters profile, it appears they are a Gitlab employee. The comment itself was confusing due to the comma after the Gitlab Employee

Will the opt-out be easily disabled during setup or will it be hidden in options?

> We are carefully considering the appropriate opt-out functionality for telemetry

There's your problem. This should be entirely opt-in.

Reply on news.ycombinator.com