Re:Remove default "terraform" partner_id
by isoprophlex on Tuesday October 29, 2019 @02:25PM
(#21390476)
Tone-deaf faceless pr Twitter accounts out there slinging corporate bullshit, take note: this is how you communicate with your community if you really care about them.
Thanks for the very thoughtful response, and thank you for providing us with your fantastic software!
Re:Remove default "terraform" partner_id
by sidcool on Tuesday October 29, 2019 @01:52PM
(#21390057)
This is a great reply. Hashicorp is one of my favorite companies. I would always give them the benefit of doubt.
Re:Remove default "terraform" partner_id
by caust1c on Tuesday October 29, 2019 @01:50PM
(#21390017)
> I can say that the usage information given by this partner code has directly resulted in more headcount being assigned to the "azurerm" Terraform provider that may not have been otherwise assigned.
In 5 days? Impressive
Re:Remove default "terraform" partner_id
by scottmcleod on Tuesday October 29, 2019 @01:58PM
(#21390132)
Thanks - Hard to make any better than direct founder reply to clear up confusion.
Re:Remove default "terraform" partner_id
by digitalsushi on Tuesday October 29, 2019 @01:43PM
(#21389946)
Thanks for hopping on here yourself, it definitely throws some bleach into the murky water.
Why an user agent is not enough to do just that?
Re:Remove default "terraform" partner_id
by mitchellh on Tuesday October 29, 2019 @02:24PM
(#21390454)
I believe they do use the user agent to a certain extent but what I've been told is that their analytics systems are better suited to work with the partner ID.
Re:Remove default "terraform" partner_id
by simplehuman on Tuesday October 29, 2019 @01:53PM
(#21390071)
Great response, thanks for clarifying in detail
Re:Remove default "terraform" partner_id
by orvtech on Tuesday October 29, 2019 @02:05PM
(#21390230)
> ...Going forward, we will be building an option to opt out of using this partner ID...
One should be opted out by default and the option should be build to opt in.
Re:Remove default "terraform" partner_id
by skywhopper on Tuesday October 29, 2019 @07:14PM
(#21393092)
Based on the explanation given, there's absolutely no privacy benefit to not including this code. The fact that it's Terraform doing the work is already being sent via the User Agent in the API requests. The fact that it's _you_ who is making the API calls is also embedded in the request. This amounts to a minor hack of Azure's API logging to enable slightly more convenient reporting. It sends no new data. In other words "opting in" or "opting out" has zero impact on whatever privacy implications you are worried about. This comes down to a simple misunderstanding of what's going on.
Re:Remove default "terraform" partner_id
by oh_sigh on Tuesday October 29, 2019 @04:13PM
(#21391468)
Most people wouldn't care about it's usage and will keep it as the default.
i dont know why this is getting downvoted
Re:Remove default "terraform" partner_id
by paulddraper on Tuesday October 29, 2019 @03:18PM
(#21391022)
Because people think it's a fine default.
Just like I think "User-Agent: curl/7.58.0" is a fine default.
Re:Remove default "terraform" partner_id
by colechristensen on Tuesday October 29, 2019 @03:29PM
(#21391122)
Given the amount of fingerprinting and screwing with the content based on platform, I'd be happy to do away with user-agent completely. I'm tired of websites that are completely broken on mobile and force you to use the app (or constantly remind you about their app) and everybody returning a globally unique identification which is so hard to scrub.
Re:Remove default "terraform" partner_id
by skywhopper on Tuesday October 29, 2019 @07:16PM
(#21393107)
Because for this specific bit of data, the value that it's set to by default has zero privacy impact whatsoever. So getting upset over nothing and yelling at a CEO who gave a great explanation of what's going on is incredibly counterproductive behavior.
I'm the founder of HashiCorp.
I want to make something clear up front that this does NOT allow us to see resource usage by Terraform user and does NOT result in credits or revenue sharing at all. HashiCorp has no direct access to this information in any form.
Before explaining "why" we do this, I do want to apologize and say that adding this without proper explanation was a mistake. It isn't clear why it's there and I think enough companies have hurt users with features like this that defaulting to a negative reaction makes sense. I'm sorry. I promise (and will explain) that our usage is not nefarious, and even further this ID does not give us access to anything directly.
The "why": the partner ID lets Microsoft better track Terraform usage internally (with data they already have access to, just lets them filter it by Terraform). Microsoft does share aggregate information with us ("x% of all Azure workloads") but does not go any more granular than that.
This information is used by Microsoft to gauge how much investment to make into Terraform as well as what resources are a priority to fix any issues or make improvements to. Microsoft is a big partner of ours[1] and as part of that partnership they employ full-time people to improve the Terraform provider. Part of making that partnership successful is measuring the output of it and this is one mechanism that allows them to do that. I can say that the usage information given by this partner code has directly resulted in more headcount being assigned to the "azurerm" Terraform provider that may not have been otherwise assigned.
Note that all this partner ID does is let Microsoft filter by "Terraform." They already have and use all information around what resources are being spun up by accounts (as you would expect any IaaS or even SaaS to do). This doesn't introduce anything else other than that easier filter for them.
The partner ID used by Terraform was provided directly by Microsoft and generated by them. It is not associated with our Azure accounts at all. This is an extra assurance that we don't have access to any partner information using this ID.
Some have pointed out that the docs specifically state that this is used for credit/revenue sharing. That is a feature of the partner ID but not one that we use. Azure is a large, complex platform and features are overloaded for different use cases. In our case, the partner ID does NOT provide us with any information, credits, or revenue. Zero.
Going forward, we will be building an option to opt out of using this partner ID. It was already noted in other comments that we made it configurable since there are other use cases for it that a Terraform user might want to set. We haven't made a direct option to opt-out and we will do that in the next release. As a workaround today, you can set any partner ID you want (an invalid value) and we will send that and that will function similarly.
Note that for years all our providers have also sent a custom user agent that notes Terraform and the version of Terraform being used. We haven't been secret about this (I've publicly tweeted about it many times), but it feels important to call out in this comment as well. This information could also be used by providers to determine Terraform usage. Similarly, HashiCorp has no direct access to this information.
I'm happy to answer any questions, and once again I'm sorry about how this wasn't communicated up front.
EDIT (2 hours after posting): We've opened a PR for adding the opt-out behavior which also includes an environment variable you can set. We plan to include this as part of the next patch release. https://github.com/terraform-providers/terraform-provider-az...
[1]: https://www.hashicorp.com/blog/hashicorp-and-microsoft-exten...