CircleCI trusts 8 analytics companies with your source code and API tokens

Re:CircleCI trusts 8 analytics companies with your source co... by ballenf on Tuesday October 10, 2017 @01:18PM (#15443538)

I feel like narrowing down what any of those companies could do to what they are doing today irresponsible. And analytics is one of the could-do's that many third party tools do offer or add on later to increase monetization or perceived value to customers.

The important point is that there are now 8 attack surfaces instead of 1. Whether they're analytics or pad-string doesn't really matter.

[ Parent | on HN ]

Re:CircleCI trusts 8 analytics companies with your source co... by danpalmer on Tuesday October 10, 2017 @01:21PM (#15443575)

I agree there are now 8 attack surfaces, but to call all 8 "analytics" I does not think does justice to the reasons why CircleCI may have chosen to use some of them.

[ Parent | on HN ]

Re:CircleCI trusts 8 analytics companies with your source co... by imtringued on Tuesday October 10, 2017 @04:14PM (#15444994)

>The important point is that there are now 8 attack surfaces instead of 1.

That's the best case scenario. What if these 8 companies also give the source code to other companies?

[ Parent | on HN ]