Gitlab cancels plan on tracking user behavior on GitLab.com

We received an apology email at the same time, well written, explaining what they did wrong, apologizing, promising to do a post-mortem, promising to not send to 3rd party trackers, and saying they did a mistake and waiting for feedbacks on the issue tracker. And with very little BS in the mail.<p>Such level of transparency, of apologizing and clarity, especially written at the first person &quot;I am truly sorry.&quot; is very rare and should be praised.

The reaction to this whole saga has been insane. Chill out people.<p>They fucked up, users gave feedback, they listened.<p>This isn&#x27;t some corporate conspiracy, some grand ethical dilemma with an evil company on one side and some white knight hackers on the other.<p>Let&#x27;s imagine for a second that they are people trying to do the right thing, with years of history doing the best they can.<p>They wanted to measure usage to make their product better. People seem to disagree, which, okay, but the outrage here is everything wrong with the internet.

I don&#x27;t see where it is canceled. The closest thing I see to canceled, is postponed.<p>From the update: &#x27;We will not activate user level product usage tracking on GitLab.com or GitLab self-managed before we address the feedback and re-evaluate our plan.&#x27;<p>That leaves a lot of wiggle room.

This comment, from the CFO, is particularly nasty: <a href="https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;merge_requests&#x2F;14182#note_203849107" rel="nofollow">https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab&#x2F;merge_requests&#x2F;14182#no...</a>

This is just the beginning, at some point, they will flip. Google was our darling, that could do no wrong. Just imagine, to be bold and say &quot;Don&#x27;t be evil!&quot; And then, what happened? This is just a short term reaction to quiet down the noise, but their long term hand has been exposed. They are not going to do it, but note that nothing says they won&#x27;t try to or do it again in the far future.<p>What I really will like to know is how they will profit off that data. Is it even going to make a bump on their bottom line?

Gitlab has also committed to doing a post-mortem on this, just as they do for crashes or data breaches, which is a good thing.

We sent an MR to Gitlab 1.5 years ago (<a href="https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab-foss&#x2F;merge_requests&#x2F;15697" rel="nofollow">https:&#x2F;&#x2F;gitlab.com&#x2F;gitlab-org&#x2F;gitlab-foss&#x2F;merge_requests&#x2F;156...</a>) implementing our open-source analytics tool to their app and letting the system administrators opt-in to this feature if they want to analyze their user behavior but it looks like Gitlab wanted to implement a centralized user tracking feature for themselves instead.<p>However, given that most of the Gitlab customers &#x2F; open-source community cares about their privacy and want to have the control (well, that&#x27;s probably why they switched to Gitlab from other products), I wonder why they wanted to follow this approach in the first place. The good thing is that they almost always know how to take action when their community reacts.

This is incredibly dumb. Both Pendo and Snowplow are analytics providers, meaning they both have in their TOS that the company remains the owner of the data in question and that the services only exist to facilitate analysis of the data in question.<p>Effectively this is users complaining that Gitlab wants to simplify their data analysis overhead. Presumably nothing precludes them from sending the exact same data to these companies and more on the backend. What do users expect? For Gitlab to build every single part of their stack in-house (CRM, analytics, support tooling, etc)? Because that&#x27;s what this is effectively asking for.<p>What&#x27;s next? Protesting that a company uses RDS instead of their own hand-rolled Postgres setup? Because this is the same level of stupid.

Could someone here please explain to me why Gitlab&#x27;s product managers would be so interested in client-side analytics in the first place? From my familiarity with their service, almost every operation requires an ajax call, or a full page refresh. Is there really that much value for the product managers in these additional analytics?

I find the anti-telemetry attitude honestly kind of confusing. I mean, you know that the shops you go to know what products you&#x27;re buying from them, right? Presumably those shops look at that data in aggregate when thinking about which products to stock. How is this any different? If you&#x27;re transacting with someone, it&#x27;s not possible to hide that transaction from them. Of course you should have the right to have that data deleted, but that&#x27;s different from saying it should never be collected at all.<p>Also, given that nearly all websites are using something like Google Analytics or similar (or several of these at once), the reaction and vitriol here just seems weirdly disproportionate.

&gt;We have not yet added instrumentation to the Enterprise edition versions, and we will not do so until we have a way for self-hosted customers to opt out... (Scott Williamson, Gitlab VP of product, responding to the OP)<p>That&#x27;s not the right way to do it. Customers should need to opt in, rather than having to opt out.

I&#x27;m glad they reversed course and apologized but it still amazes me how powerful the reality distortion bubble can be even at well-meaning corporations. It&#x27;s as if there was a meeting at the Red Cross where somebody said &quot;Hey why don&#x27;t we start selling guns? It would be a great fundraising tool.&quot; And everybody in the room just nodded and said &quot;Yeah that&#x27;s a pretty great idea. Let&#x27;s start tomorrow!&quot;

The real reason you shouldn&#x27;t be using GitLab is performance. How is it possible that that page took over a minute to load? Nevermind that the design is completely incomprehensible.

How can you trust a company like GitLab whose default decision is always bad and then they change direction after public outcry.<p>Either they don&#x27;t think before they make decisions or they are just trying to figure out what they can get away with.<p>This really shows their lack of morality. They kind of remind me of Facebook.

I don&#x27;t understand, what changed? This was last updated on the 24th. They said they&#x27;ll be re-evaluating it and returning later, but afaict they haven&#x27;t made any statements about a blanket cancellation of the telemetry roll-out.

remember when everyone was bailing on github because of evil microsoft?

I&#x27;m happy to enable telemetry on my self-hosted Gitlab if that makes gitlab better, maybe make it opt-in instead opt-out?

Something a little ironic about putting a tracked click link in an email apologizing for adding tracking. That said I firmly believe in opt-in tracking and would likely enable it for my gitlab usage.

Long story short, if Gitlab were to use a open source &amp; self hosted platform (like Countly) with a clear mentioning of what to collect and what not, clarifying that nothing is collected which is not anything unknown to them, there would be no problems. Gitlab CEO has provided the right response with the right tone, which is something we don&#x27;t usually see in big corps. I again would like to stress that such platforms not use 3rd party analytics providers but a self hosted and&#x2F;or in-house solution.

This just tells me that someone needs to continue working on Gitea or another open source alternative so that you can easily self host something comparable to GitLab enterprise. Yes, GitLab has an open source CE version but it has limited functionality. If another open source solution can implement the same functionality as their enterprise product, then GitLab will be forced to adopt or risk losing their business. Time to put some pressure on them.

How is this different from the telemetry that VS Code is collecting? The &quot;community&quot; seems to have swallowed that pill with much less complaining.

I&#x27;m normally one to hold a grudge. I still don&#x27;t buy Sony products for something they did over a decade ago. In this case I think forgiveness is appropriate. There are obviously people working at Gitlab who have terrible ideas, but the organization seems to be able to deal with them in a healthy and transparent way. This compares favourably to companies like Zoom or Equifax.

&gt; It shouldn’t have surprised us that you have strong feelings about opt-in&#x2F;opt-out decisions<p>Well yes, it should be obvious by now that requiring users to opt out to avoid some privacy-violating behavior is a facebook-class dark pattern.

Is this supposed to read &quot;misunderstands&quot;? And if not, could you elaborate?

Well, I suppose that&#x27;s The Gitlab Drama for this quarter. &#x2F;s

Maybe I&#x27;ve missed the boat, but what&#x27;s the big deal about collecting telemetry?<p>You already trust Gitlab with everything you store in Gitlab, like source code, which is presumably much more sensitive than the number of times you loaded a page or clicked on a button or whatever.<p>Is it because the data would be stored with a third party, and you don&#x27;t trust that third party? If Gitlab trusts the third party, and they&#x27;re giving you the option to NOT trust the third party and only trust Gitlab, what&#x27;s the issue?

Great attitude. Interesting correlation with the episode S06E01 of Silicon Valley released this week, on the same topic :)

I&#x27;m impressed by the way Gitlab is communicating on a personal level with all of their users on email bombs.

If i compare this to StackOverflows communication, I like this way a lot more.

I think it would be more acceptable if they let users preview the data sent

If I pay for a product (on-premise), it&#x27;s not your business what I do with it.<p>If I use the free hosted service (ex: gitlab.com), then this is the price to pay for a free service (within legal rules like GDPR).<p>BTW, it&#x27;s too late for me. I&#x27;m about to move all my stuff to a self-hosted Gitea (on a cheap VPS) in addition to Matrix, Mastodon, ...

how did they get caught?

it still boggles my mind how one can use gitlab.

Is it possible to enforce american spelling ( especially in the title )? Behavior vs Behaviour?<p>HN is an american company and gitlab is an american company so people who participate here should use correct american spelling.<p>The gitlab post itself uses the correct spelling - behavior.<p>&quot;In an effort to improve our user experience, we decided to implement user behavior tracking with both first and third-party technology&quot;