Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kite telemetry code in Sublime package SideBarEnhancements

forum.sublimetext.com

Post reply on HN
Print view View original

11–20 of 120 posts

Re: Kite telemetry code in Sublime package SideBarEnhancements

#11

Post by mawalu »

bajabaron wrote: post #8
bajabaron wrote: post #2

they're also obscuring who this log data is being sent to by just posting JSON to an ec2 IP address (52.52.168.91). The server tries hard to not let you know it belongs to Kite. You know someone is ashamed of what they're doing when they take efforts to mask who's doing it. But you can see kite's own installer uses the same ip address for its telemetry: https://github.com/kiteco/kite-installer/blob/master/ext/tel...

It might be worth searching every release in the package_control_repo for this IP address... https://github.com/wbond/package_control_channel/tree/master...

Seems not to be included in any other file on github: https://github.com/search?utf8=%E2%9C%93&q=%2252.52.168.91%2...

Re: Kite telemetry code in Sublime package SideBarEnhancements

#12

Post by numbsafari »

omginternets wrote: post #3

The best course of action in such cases is to vote with your feet.

The question is: to where?

Is there a single IDE with plugins that has a security model in place that would prevent plugins from being taken over by nefarious asshats?

I love vim and emacs... but what's to keep them from being affected by the same thing? Who has time to read all the source code of every plugin/dependency that they use?

It's all about trust and what Kite is doing is completely destroying the network of trust in each of the communities they choose to infect.

Re: Kite telemetry code in Sublime package SideBarEnhancements

#13

Post by wbond »

wedowhatwedo wrote: post #9

I modified the Stats.py file in the SideBarEnhancements.sublime-package on my computer to remove the line that references this IP address. I also made the file read-only so it won't get updated. Does anyone know if that will take care of the issue on my computer for now?

A new version of SideBarEnhancements is out with the stats removed. You should get automatically updated the next time you restart Sublime Text or manually upgrade the package.

Re: Kite telemetry code in Sublime package SideBarEnhancements

#14

Post by Artemis2 »

mawalu wrote: post #11
bajabaron wrote: post #8

Earlier quoted context omitted.

It might be worth searching every release in the package_control_repo for this IP address... https://github.com/wbond/package_control_channel/tree/master...

Seems not to be included in any other file on github: https://github.com/search?utf8=%E2%9C%93&q=%2252.52.168.91%2...

Shouldn't this search find the kite-installer repo? The IP does not exist anymore in SideBarEnhancements but is still in this repo: https://github.com/kiteco/kite-installer/blob/master/ext/tel...

Re: Kite telemetry code in Sublime package SideBarEnhancements

#15

Post by digikata »

bajabaron wrote: post #8
bajabaron wrote: post #2

they're also obscuring who this log data is being sent to by just posting JSON to an ec2 IP address (52.52.168.91). The server tries hard to not let you know it belongs to Kite. You know someone is ashamed of what they're doing when they take efforts to mask who's doing it. But you can see kite's own installer uses the same ip address for its telemetry: https://github.com/kiteco/kite-installer/blob/master/ext/tel...

It might be worth searching every release in the package_control_repo for this IP address... https://github.com/wbond/package_control_channel/tree/master...

or maybe any plain ip address... Or the more solid precaution may be to interpose on the sublime supplied network interface api and give people a log of which packages are accessing the network and what addresses.

Re: Kite telemetry code in Sublime package SideBarEnhancements

#16

Post by wishinghand »

numbsafari wrote: post #12
omginternets wrote: post #3

The best course of action in such cases is to vote with your feet.

The question is: to where? Is there a single IDE with plugins that has a security model in place that would prevent plugins from being taken over by nefarious asshats? I love vim and emacs... but what's to keep them from being affected by the same thing? Who has time to read all the source code of every plugin/dependency that they use? It's all about trust and what Kite is doing is completely destroying the network o…

I think the person you're replying to meant not using Kite.

Re: Kite telemetry code in Sublime package SideBarEnhancements

#20

Post by eropple »

So this is something I'm not sure I've ever said before, but if you work for Kite, you need to quit.

Like, I get working for even exploitative companies (though I won't)--economic insecurity is definitely a thing and we all gotta eat. But you can find a job that doesn't involve literally spying on the down-low. I promise you, you can.

Abandon these jerks before they bring you down with them. They've demonstrated a willingness to screw people and even if you don't really care about them screwing other people, they'll screw you too.

EDIT: Also, because it's on-topic and the post on HN seems to have gone ignored, somebody is typo-squatting `cross-env` on NPM and dumping environment variables to a Chinese server run by "HackTask", it probably deserves a signal boost: https://twitter.com/o_cee/status/892306836199800836 https://news.ycombinator.com/item?id=14901566

Post reply on HN