If your IP (and possible your browser) looks “suspicious” or has been used by other users before, you need to add additional information for registration on gitlab.com, which includes your mobile phone number and possibly credit card information. Since it is not possible to contribute or even report issues on open source projects without doing so, I do not think any open source project should use this service until they change that.
Screenshot: https://i.ibb.co/XsfcfHf/gitlab.png
Policies like that are almost entirely about minimizing fraud and harassment. It really sucks for people who don’t have mobile phones that support authentication texts or whatever (since, even as you pointed out, the requirement is mostly a phone number) but it also drastically cuts down on fake/harassment accounts.
Even Github does not require any personal information, so there are certainly other ways.
And Github is Microsoft who need those capabilities for basically every other website they sell.
Whereas gitlab is REALLY good software with… a website nobody ever really asked for but that still needs to exist to sell people that software.
This comes up with a lot of services. I think everyone lost their god damned minds when overwatch added phone verification?
Like, I don’t like it. But I have friends who ahve had to deal with harassment campaigns against their products (or persons) and the like and get why you would do what, on the surface, is a pretty trivial ask as a way to remove sock puppets.
I don’t think having my real life phone number tied to a website or game account is a trivial ask. I’d like my data to be private, especially something as real-life and tangible as a fucking phone number. Sure, there are ways around these things, you can get a fake phone number for cheap (or possibly even free), but that’s rather more effort than I’m willing to put in for most things. If I need to enter a phone number to sign up for an account for something, chances are very extremely good I’ll just decide I don’t need the account that badly. I don’t think I’m alone in this.
Except phone number is super cheap.
It is still a monetary investment which is a major deterrent to bad faith accounts. This is why so many live games have a “you need to spend 1 dollar to get into the good queue” model. Shit like Escape from Tarkov where people buy accounts en masse are very much the exception.
But also? The issue is, like with mots things, lower income users. A lot of the cheaper/more affordable “pay as you go” phone plans won’t support the SMS authentication services that these models depend on. Which is why I referenced Overwatch 2 since that was actually a really “good” example of the reasons this is not a good model.
TF2. Even in official competetive mm with phone verification and spending money there are lots of bots.
Is it even legal?
There is no one solution that handles everything (or else everyone would just do that). It is always about a mixture of multiple methods.
This is the internet. Someone will always claim it is illegal in “Europe”. Nobody will care enough to verify one way or the other. And, regardless of whether it is or is not, companies don’t care because most of those regulations are very toothless either due to bureaucratic inertia or just not giving a fuck.
The fact of the matter is that this is a very common model used by a range of services and it is not going to get challenged any time soon.
It’s about data harvesting and selling not safety or any other mentioned.
Gitlab was getting attacked with thousands of spam accounts. Trying to fix the damage almost killed the company
It’s disgusting.
It should be illegal to require any personal information unless you can prove that it’s literally impossible to provide your service without it, and always illegal to share that information with anyone (but a payment provider exclusively for verification purposes) for any reason.