[omarhaneef]

The number of daily sign ups for sourcehut.

This is billed as a competitor to GitLab.

GitLab announced something about allowing some sort of telemetry on its site -- I didn't look into the details but its all over HN -- and people have complained that this might imply privacy violations.

So this alternative to GitLab got a bump in signups.

[sytse]

We also called out our signups at GitLab when GitHub got acquired, so it is more than fair that Drew is posting this.

BTW As Drew said https://gitlab.com/gitlab-com/www-gitlab-com/merge_requests/... we're pumping the brakes on the telemetry changes.

[0x8BADF00D]

I got an email from you guys yesterday and I have to say I was quite confused. My company is an EE customer and we pay for our seats. Why are you including this telemetry? For the free version I understand, but you should not be treating your enterprise customers like this.

[sytse]

I'm sorry our plans were so far off the mark.

[protomikron]

> [...] we're pumping the brakes on the telemetry changes

So you revert (don't implement it)? Thx! Reverting it is the right decision (I hope that means "pumping the brakes").

[esotericn]

From what I can tell they're still going to do it, but in a different way, e.g. it might be opt in (hopefully not in a fake-opt-in style like a GDPR popup) or opt out or whatever.

Fundamentally they want to do telemetry it seems and are trying to figure out a hack to get people to accept it.

[emilycook]

(GitLab employee) we're discussing other options too, I'm personally advocating strongly against just going ahead with the current plan. My preference would be for no third-party involvement and just better ways to analyze the data we already have

[acrispino]

Pump the brakes? No. Reverse course, before your product ends up in the same place as github.

[scrollaway]

I got Gitlab's email and immediately knew people would be freaking out about it.

The fallacy of transparency: The more transparent you are, the more people think you're up to some shady shit. It's crazy.

[whatshisface]

Do you think that if they had just put the tracker in nobody would have noticed? I think it would go silent for a month, and then become the subject of a top-of-HN blog post about how some enterprise security guy discovered it. Gitlab would write a blog post about how sorry they were, nobody would believe them, and there would be no way to un-do the breach of trust. By allowing everyone on HN to tell at them not to implement the change before doing it, they have made themselves able to avoid the catastrophe by cancelling the plan. Although the best thing Gitlab could have done for their public image as a trustworthy service provider would be to never have even let on that they would consider such a thing, this is the next best option, because whoever wanted to do this now has lost some internal political credibility.

[scrollaway]

I'm sure people would have noticed. Hell, some may have noticed immediately. But it would have been a non-story unless everyone got an email and had to google around for what's going on and figure out whether they need to be outraged.

[JohnFen]

That's not the fallacy of transparency. The real fallacy is when companies think that doing shady shit is OK as long as they're transparent about it.

[scrollaway]

Someone's going to have to explain to me how Gitlab is doing something shady with this stuff.

Unless I'm misreading all this, it all looks like very standard telemetry, the same kind Github is doing.

[gbear605]

Part of the issue is that proprietary software would be running from a company that advertises itself as being oriented around free software.

In addition, it would apply to the enterprise deployments, which is bad because enterprises can’t allow telemetry for regulatory and security reasons.

[scrollaway]

> Part of the issue is that proprietary software would be running from a company that advertises itself as being oriented around free software.

They're also running on Google's cloud, which is mostly proprietary software. And I can tell you right now they use the most-definitely-closed-source Salesforce for a lot of stuff.

Do you think there's actually a significant amount of people who care about the license type of the internal tools of the companies they use?

[gbear605]

None of that is frontend though, which is an important distinction.

[JohnFen]

I'm not claiming that Gitlab is doing anything shady with the data, I'm making a general comment about the notion of "transparency" as a panacea.

I do object to what Gitlab proposed, though, because I object to all telemetry that I don't specifically opt in to.

[adventured]

I think it's a lot more simple than that and has everything to do with the privacy environment today. People in tech really, really, really dislike it when the products/services they use attempt to track them (generally speaking). There is very little trust these days on such matters, the default setting for tech people is to not trust companies that go anywhere near privacy violations, surveillance, tracking, et al. rather than giving the benefit of the doubt. Gitlab should have seen this coming a million kilometers away.

[scrollaway]

> People in tech really, really, really dislike it when the products/services they use attempt to track them (generally speaking).

This isn't even sort of generally speaking true. Nearly EVERYONE on HN is aware to some extent how incredibly massively they're tracked by their ISP, by Google and Facebook, by their phone, by their phone's manufacturer, by their operating system, by the security cameras in all the shops they visit, by proxy through all their friends who aren't as privacy-conscious as they may be, etc.

I see very few people "hating" this. And I say it as someone who does hate it. Most people here are aware of it, and they all have the "tingly feeling", but most actually do choose to actively ignore it. "I don't have to deal with the idea that my phone is tracking me until there's public outrage abou tit" sort of thing.

And I'm not stubborn enough to put "gitlab wants to know how their product is being used" and "samsung wants to know what I'm watching and when" in the same bucket. And given how much of an improvement gitlab is over the status quo, I also know not to make enemies of my closest allies.

[orclev]

There's also elements of selection bias as well. If you're highly transparent it's likely that people who value that will be drawn to your product, so when you subsequently take steps to reduce that transparency somewhat (such as roping in a third party from an industry known to engage in shady things), and make it mandatory for users in the most intrusive way possible, it's likely to garner a bigger backlash than for a less transparent product because your user base cares about that sort of thing more.

[indigochill]

Well, when you're transparent about adding features that users don't want, I don't think it comes as a surprise that users express they don't want those features.

Granted, Gitlab wants telemetry in order to understand how Gitlab is being used. I'm sympathetic to their goal. But I'm also sympathetic to a sort of "NIMBY" response from users even if overall telemetry might improve the ecosystem for everyone. It's a sort of "tragedy of the commons" situation.

[authoritarian]

If you're transparent about doing some shady shit, you're still doing some shady shit

[eitland]

Have you considered that often the reason why we don't complain about the worse alternatives are that we already are avoiding them/mitigating them?

Not always, but often.

[fatbas202]

Thank you for providing context.