Kite telemetry code in Sublime package SideBarEnhancements

Post by hsod » Wed, Aug 02, 2017, 5:43 AM UTC

AdmiralAsshat wrote: post #105

sillysaurus3 wrote: post #44

Earlier quoted context omitted.

This seems incredibly overblown. According to the diff, all they were collecting is time spent editing certain file extensions, along with a list of installed packages: https://github.com/SideBarEnhancements-org/SideBarEnhancemen... They're trying to figure out what languages people are actually editing on a day-to-day basis, and people here are calling for them to leave the company? Like, really? People have been wh…

So, to use an analogy: "Yeah, we broke into your house and rummaged through your stuff, but it's okay, we were only there to count how many spoons you had. Yes, I know, we could've asked you before we broke into your house, but we tried that before, and for some reasons we had no takers. And it was really important to our researchers that we get a good idea about the number of spoons!"

Post by omginternets » Wed, Aug 02, 2017, 9:29 AM UTC

numbsafari wrote: post #22

wishinghand wrote: post #16

Earlier quoted context omitted.

I think the person you're replying to meant not using Kite.

What keeps Kite from taking over another package?

Post by 65827 » Wed, Aug 02, 2017, 11:05 AM UTC

cisanti wrote: post #47

eropple wrote: post #20

So this is something I'm not sure I've ever said before, but if you work for Kite, you need to quit. Like, I get working for even exploitative companies (though I won't)--economic insecurity is definitely a thing and we all gotta eat. But you can find a job that doesn't involve literally spying on the down-low. I promise you, you can. Abandon these jerks before they bring you down with them. They've demonstrated a wi…

Kite is a small fish in the bond... everyone working for FB and Google should be ashamed of themselves for working spy machines. I mean it. It sounds harsh but that's the way it is. But I guess money trumps morals.

Post by matty22 » Wed, Aug 02, 2017, 2:28 PM UTC

rankam wrote: post #87

kuschku wrote: post #57

Earlier quoted context omitted.

It's not okay for websites doing this, and any website doing this from May 2018 on will end up fined hundredthousands of dollars every time they do this. The European General Data Protection Regulation [1] is coming, and everyone that doesn't comply with it will have more than just a little problem. No site or program is allowed to track or store anything about me, to transmit anything to a third party, or to even co…

I don't know anything about the regulation and just skimmed the Wikipedia article for a minute, but isn't this regulation unenforceable in practice? If I have a website, how am I supposed to know if a visitor is a citizen of the EU? If my company operates outside of the EU, the EU has no jurisdiction.

Post by AdmiralAsshat » Wed, Aug 02, 2017, 8:06 PM UTC

mattbierner wrote: post #101

fooey wrote: post #67

Earlier quoted context omitted.

Seriously. Sublime, Atom, VSCode, and every other platform that supports plugins should all be in crisis mode over the crap Kite's been caught doing. If we can't trust that an addon we installed yesterday is safe today, their platforms just turned into gigantic malware vectors that are totally wide open. This kind of exploitation needs to be stopped immediately.

I work on VSCode. We are aware of the possibility of bad plugins or even good plugins that go bad. The real nightmare scenario would be what's happened with some Chrome plugins, where a widely used plugin is either co-opted or bought out and becomes malicious (even worse if it disguises its maliciousness). All of these package ecosystems are similar to NPM in that they are built on trust and community policing. This…