top | item 32326573

GitHub is adding web cookies for enterprise users

108 points| 6a74 | 3 years ago |github.com

83 comments

order

ocdtrekkie|3 years ago

On one hand, it sounds like it's only on marketing pages, which I never visit anyways.

On the other hand, in December 2020, they said "We are also committing that going forward, we will only use cookies that are required for us to serve GitHub.com" and apparently in corporate terms, a "commitment" lasts less than two years now.

Presumably the main change here is Nat made this commitment and Nat has since left Microsoft, but it's hard to believe their marketing team thinks the data value from a couple marketing pages is worth the PR hit from this. Just a dumb--- business move, really.

zzo38computer|3 years ago

Someone suggested using a different domain name for the marketing pages. I think that this would be a good idea, then you can clearly tell the difference. And, if the different domain name is something other than "GitHub.com" then the commitment mentioned in December 2020 is still valid.

As long as it only affects the enterprise marketing pages (which, like you, I do not use) and it is clearly documented (unfortunately some of the documentation changes seem confusing, and I am not the only one who thinks that), then I have no problem with this.

(I do not use GitHub for my own projects, but I do use it to view other projects and to communicate with other projects that do use GitHub. In future I might also set up mirrors of my projects on GitHub, but the main working of the project will not be on GitHub.)

dahdum|3 years ago

Sounds like they are adding cookies to their marketing landing pages for enterprise ads. Not that they are running ads on GitHub.

Is there something more to this?

meibo|3 years ago

No, but people are looking for any reason to claim that MS has ruined GitHub so that the loud Twitter predictions they made during the acquisition aren't as embarrassing.

zzo38computer|3 years ago

They changed the section about DNT, which makes it confusing. If GitHub can use DNT, then they should mention that (like it had before). If GitHub does not use DNT, then they should delete that section.

The same section mentions Privacy Badger and uBlock Origin, which they could mention anyways if they want to do, but they should mention that GitHub is not affiliated with them (even though some of these projects might be hosted on GitHub).

lopatin|3 years ago

People seem outraged about the marketing cookies. Genuine question: Why?

armchairhacker|3 years ago

Slippery slope. First it's cookies for marketing, then it's selling your data, then it's "sponsored" repositories showing up in search. Next thing you know, recruiters are cold-calling you with your private email address and you can't even get to your own README without scrolling past banner ads and autoplay videos. After all, that's pretty much how the rest of the web works.

Do I really think that's going to happen? No. If GitHub were to introduce ads or invasive marketing everyone would move to GitLab in a second. A decent amount of people are already moving to GitLab and GitHub hasn't even done anything! Things like marketing cookies for analytics on marketing pages are genuinely not an issue.

But people take it as a sign, because of all the shit that goes on the rest of the web, and how GitHub explicitly said they were not going to do this. The fact they made a "commitment" not to do this is particularly important because it shows that GitHub's promises don't mean anything.

But migrating your repo is easy. Personally I'm going to wait until things actually get bad before moving.

baobob|3 years ago

GitHub made a huge fuss in a blog post about their compliance with the ePrivacy directive not more than 2 years ago. I personally found their approach and interpretation interesting and unique, so this change seems noteworthy for that reason alone

hatware|3 years ago

> marketing cookies

Do you think ads have gotten better or worse over time?

I think it's unequivocally worse now than it was then. There's a point where you're fed up with seeing the same ads for products you don't want or need.

WhyNotHugo|3 years ago

These are used to track around a person.

Imagine if a store put a tiny sticker on anyone who stopped by to look at their products. Not this person is identifiable as "stopped to look at product X" whenever they visit other stores from the same owner.

Personally, it just creeps me out, even though it's basically the norm online.

jacamera|3 years ago

I left a thumbs-up reaction on the GitHub post. The cookie outrage is completely absurd.

propogandist|3 years ago

developers are typically unreachable to marketers. This will be MSFT unlocking a rare audience that will fetch top dollars from enterprise advertisers, right before cookies go out of standard.

This move, like the exclusive Netflix ads inventory, makes it clear that MSFT sees ads as a big driver to business growth.

WhyNotHugo|3 years ago

I'm sure they'll ask for user's explicit consent before planting any cookies, as required by current legislation, right?

I can't imagine many developers opting in.

renewiltord|3 years ago

The user tracking makes sense, but ads are weird in this product. There's no way it makes sense to add ads to paying customers. That's strange.

pessimizer|3 years ago

Makes a lot of sense. Paying customers are far better ad targets than deadbeats.

gtirloni|3 years ago

Another PR that will be closed to comments pretty soon because of the mobs.

mikro2nd|3 years ago

Doesn't matter, because, "These updates will go into effect after the 30-day notice and comment period".

i.e. "Comment all you like, we're steaming ahead with this stupid idea regardless."

jacamera|3 years ago

I don't understand why people care about cookies. The stupid cookie banners are an actual nuisance.

pbreit|3 years ago

As much as I loathe the cookie warnings, I'm constantly amazed at situations that don't avoid them. For example: there is no reason that PayPal needs to serve 3rd party cookies in a payment flow.

I've actually started to reject nonessential cookies most of the time now. Doubt it matters at all.

booleandilemma|3 years ago

They almost feel like a passive-aggressive thing at this point. There's no reason a cookie banner needs to be a modal dialog that blacks out the rest of the web page.

autoexec|3 years ago

You really don't understand why people don't want to have their internet history logged or be tracked as they browse the internet? Cookies that track you are bad. The banners are bad too.

e2le|3 years ago

Only consent is needed for cookies that aren't strictly necessary.

https://gdpr.eu/cookies/

If a site is asking for consent, they're either idiots who don't understand what the law requires of them or they intend on tracking their users.

ocdtrekkie|3 years ago

The nuisance is an intentional choice by the bad actors in marketing to make you mad about the banner instead of their business practices of tracking you everywhere.

Understand that cookie banners are malicious compliance and they make a lot more sense.

systemvoltage|3 years ago

Yep, this is why we can't have nice things. Nice things sometimes sound nice initially but they have major design flaws and made by people who don't know much about things. But these people have monopoly of coercion on you so you can't really do anything about it.

> “The legislative department is everywhere extending the sphere of its activity, and drawing all power into its impetuous vortex.” -Madison, Federalist No. 48

HN is still in a love affair with GDPR.

Nice things need to be thoroughly thought out.

matt3210|3 years ago

There are tons of open source GitHub alternatives, why does opensource still use GitHub? Why does anyone?

pessimizer|3 years ago

Why does all academia do volunteer work and publish in journals owned by private companies with like a 70% profit margin?

Collective action is hard, and it's even harder when billionaires make conscious, organized efforts to disrupt it.

zzo38computer|3 years ago

I do not (and will not) use GitHub for my own projects, although I use it for viewing other projects that do use GitHub and for communicating with them. Mirroring projects on GitHub (and possibly other services too) even if the main working is not on GitHub, is also possible (I might add mirrors on GitHub and others in future, but currently I only have the main working hosted on my own computer and the mirror on Chisel, and I still intend to keep both of these even if there are mirrors on other services too). (Even SQLite is mirror on GitHub even though its main working is hosted by themself instead and is not even using git.)

I would not recommend using GitLab unless it is not the only mirror of your project (it is acceptable if you are mirroring it on something else, too). If you do want alternatives, you may consider Codeberg, NotABug, and/or Sourcehut. The reason I exclude GitLab is because it cannot display the files unless JavaScripts are enabled (or if you use the git protocol, which is kind of confusing compared with fossil) (it is OK if it uses JavaScript for other functions as long as the files can be viewed without it) (this is not a problem if there are other mirrors, since you can view the mirrors instead).

arjvik|3 years ago

Network effect

sneak|3 years ago

This is Microsoft we’re talking about here. They provide OSes and PowerPoint for the CIA laptops that plan extrajudicial assassinations and torture sites, and groupware for the concentration camps for children down in Texas; their blatant commercialism is perhaps the least gross thing about them.

Imagine the most terrible dark patterns from LinkedIn (which they also own), and go self-host Gitea and move your repos.

silversnitch|3 years ago

So if CIA uses GNU/Linux and Libreoffice then should we gross out about Linux and stop using it?

Microsoft might have billions of problems but CIA using windows and PowerPoint isn't one of them.