Sentry new TOS to use data to train AI with no opt-out

I took a quick look at this. Is SigNoz primarily for server observability? One thing I’ve used Sentry for a lot in the past is client-side logging – client-side JavaScript, native iOS, and native Android. SigNoz doesn’t do that as far as I can see?

Or to setup one, I think spinning up with Docker Compose with a slightly older version should be possible, last I checked.

If you are looking for an alternative after this change, I can highly recommend AppSignal: https://www.appsignal.com/

They are based in The Netherlands so I don’t expect them to come up with something like this.

Only on free accounts, on paid accounts its up to current pay period expiration

> it did not seem all that obvious an opt-out was needed

That doesn’t help seem like people making decisions at sentry are caring about their customers. I left sentry for other reasons but this just reinforces my decision to leave.

>...and will follow up here >...happy to answer specific questions

JFC, how much are your overlords paying you for such corporate drivel..?

There is no discussion to be had, here. Such a service ought'ta LEGALLY be `opt-in`, and inability to even opt-out is also INTENTIONAL.

> did not seem all that obvious an opt-out was needed

WOW JUST WOW

why can't companies be honest that they want to gather data so they could get higher valuation and sell that data in some cases for profit instead of making such shameless statements?

> As for the opt-out: given the scope of how we are using usage and service data it did not seem all that obvious an opt-out was needed. We did receive the feedback however and will follow up here.

A good rule of thumb for vacuuming customer data in enterprise environments is: everything needs an opt-out (I'd even say that almost every instance of it should be opt-in).

You can't assume that all of your customers are ok to provide their data to a black box owned by you, sometimes that might even create regulatory issues they need to be aware of. Even if historically your ToS restricts how you can use said data, it creates a risk that one day you might not be so restrictive, we are all very aware of companies slicing the salami to further encroach on customers' data.

It sounds really strange that a company serving enterprise customers is not thinking in those terms.

Have you considered your target audience when writing or before sending that email about that TOS change?

What really peeved me was that bit:

> If you do not want to be governed by the updated TOS, be sure to close your account before the updated TOS applies to you.

My immediate reaction was to look for alternatives to Sentry and/or to self-host for the time being. Judging by the comments here I'm not the only one. Instead of this cold, matter of fact kind of tone, why not explain the reason for wanting to collect data, give an example, etc.

Why not sell this as a win instead of telling us to fuck off if we don't like it?

If you move forward with these changes will they apply to customers bound by HIPAA who you have a BAA with?

Not super surprising that there are a bunch of negative comments here, but as a customer I appreciate the candor and especially the note that most competitors already have similar terms.

All fun and games until that AI model accidentally reveals confidential technical details about issues you have/had to competitors.

Because logs contain also unexpected errors which could have personal data or product internal details which could leak to the outside.

Its not just simple logs at the end of the day, so there are two things to be aware of:

1. Logs will, no matter how well you do your job, contain something sensitive. Typically this ends up being customer data (PII). PII is the largest customer to most customers.

2. IP is _very_ present in logs, and especially in the types of data Sentry gathers (e.g. stacktraces). While not everyone is hyper sensitive to their code being on other systems, some companies treat it much more seriously. One particular example is the gaming industry, where projects are kept tightly under wraps and often take a decade+ to commplete.

Regarding your note on the Tos Change, ours (Sentry's), and every other coroporate ToS I've ever looked at, always included some kind of clause to allow a change within a time window, without updated consent. As an implementor I understand the need for this (think about maintaining old versions of software, same paradigm), but as a customer I understand your sentiment as well.

That said, many customers end up on annual terms of service with slight variants, particularly larger customers. This is a typical negotiation process as many of the needs/demands of organizations vary slightly.

Sentry customer here,

I understand that you don't want to be in the business of sharing your customer's IP, but it's hard to not see using your customer's internal diagnostic data for training as exactly that.

A universal opt-out of sharing data for training would go a long way in assuring me that I'm not about to find out that another customer is getting a snippet of quasi-private information (not sensitive to be PII, but not public enough to share). I can imagine that this'll be fine for a lot of customers but it makes me very uneasy.

Heck, you could probably incentive some users into sharing their data by gating "AI" features behind not opting-out.

Customer here.

A) This raise a huge issues with IP and HIPAA. Unless you add specific limitations of model per customer with 0 shared information

B) I do not know what kind of product discovery process you did to think that "industry benchmarks" are what your customer wants, but its not. As an analytics startup owner I can tell you these are the kind of low effort "Features" people tell themselves their customer wants and its never holds when you actually perform discovery.

C) This is maybe something you want for your next VC round? do you need to shove proprietary LLM model to expand the valuation? I hope you do not crash and burn doing this.

D) When I opened my current startup I started with Sentry without even thinking about it, as it was what I used in my last company and it just worked. Sure as hell going to checkout Datadog and the alternatives as we speak. We are currently on a monthly plan, you tell me I have until Jan 26 to drop the service?

> can we show your production average latency comparies to other applications?

This is pretty standard: many companies explicitly add contract language to NOT be included in these benchmarks. The reasons should be obvious, offering these benchmarks on increasingly narrow segments walks right up to betraying competitive information.

source: I work at another observability company where we DON'T share our customers information with each other

Maybe they want to sell their user's data to people training AIs rather than training them themselves?

I can imagine there lots of practical ways they can use AI - guessing the cause & solution of issues (this seems to be an off by one error, or you might want to check for null values on this line), automatically finding & linking you to related code for new errors (this failing connection was probably created over here), and detecting which errors are important and which are noise that you can ignore (the biggest problem with Sentry in my experience). In each case, training on their existing data will help a lot with this.

All of that would be future product development, but I suspect this addition is for exactly that reason: so they can begin to prepare the ground for later development, not because they're going to immediately roll this out tomorrow.

If I were running product at Sentry I'd be working on an agent that opened pull requests to fix your Sentry errors. This would work today with GPT-4 on a nontrivial number of errors/codebases.

They want the data for AI but not just for their products. They want it as a business asset. It helps boost their valuation and makes them attractive to potential acquirers, but they also can sell de-identified data outside the company per their own terms. That just means they don’t sell PII for less than two customers in a data identifiable group.

See the terms:

> Sentry may use Usage Data and Service Data for analytics and product development (including to train or improve AI Features and generate Outputs). Sentry will not disclose Usage Data or Outputs externally, unless they have been de-identified so that they do not individually identify Customer, its Users or any other person and are aggregated with data across Sentry’s other customers.

At the moment they have a feature where you can click on a button on a crash report and it will use generative AI to explain the problem / suggest a fix. Sometimes it works, sometimes it doesn’t. They also have features tied into version control where you can tag a commit to close a crash report etc. So I would expect them to be able to train on the data this gives them to suggest more accurate fixes down to the source code level.

> What would they benefit from this?

Today one of the largest challenge with Sentry at scale is that every error looks the same. If statements only get you that far. One of the ways in which we want to improve this is to use issue interaction and the event's content to predict the severity of an issue.

The second case is a version of suggested fix that uses your code to suggest actual fixes to your code. In this case the data never crosses your organization's boundary and is private to yourself.

Management see hype Management see money