13 ms·
Want to spell check? Read the fine print
- itajaja 10y agoThe plugin author should definitely be blamed for this. But I think that the root problem is with the `teacher` npm package. An issue[0] was also opened just 6 days ago raising doubts about using http. [0] https://github.com/vesln/teacher/issues/4 https://github.com/vesln/teacher/issues/4
- gruez 10y agoNo, the root problem is using an online service for spellchecking when every other decent editor does it locally.
- timhaines 10y agoThe Plugin Author is a Principal PM on Visual Studio..
- userbinator 10y agoThat makes this even more shocking. But, after seeing Microsoft's recent stance on privacy in general with things like Windows 10, maybe this is just par for the course.
- samnewman 10y agoThis is my thinking too. The use of HTTP is bad, but the real issue is trusting a third party with large amounts of potentially very sensitive information. Especially when the service in question was designed for people checking the spelling and grammar of their blog posts, something designed to be shared anyway.
- greggman 10y agoOnline spell checkers are better along many axis. For example they can spell check names in the news and slang that's likely not in an offline dictionary
- icebraining 10y agoWhy can't you just add those names and slangs to the dictionary?
- dingo_bat 10y agoBecause an online service can dedicate 10TB of disk space to spell checking, while your laptop with a 512GB SSD won't like to store >100MB for the spellchecker.
- tamana 10y agoLook up "bloom filter" and the computer science of spellcheck. You are off by a factor of 1000 or more for cost of spellcheck
- AlexandrB 10y agoI think "the cloud" is making people forget how simple some common features actually are. The default assumption seems to be that it needs to be in the cloud because it's too hard to do locally.
- onion2k 10y agoIf you had 100Mb of data I strongly suspect it'd return too many false positives - the likelihood of a string being in there would be too high. A spellchecker isn't very useful if it knows "Donald Trumo" is a real name. For reference, the hunspell dictionary file used in apps like Libre Office and Firefox is about 400kb. That's effectively the whole of the English language.
- TeMPOraL 10y agoBesides the good points made by other commenters, I'll raise you another one: want to trade space? How about cutting out some of that fat modern software comes with? Change the configuration language from XML to JSON and you'll suddenly have space for 10 spellcheckers. Cut out that pointless high-resolution banner and you'll have space for 10 more.
- voltagex_ 10y agoYou'll probably have more luck raising issues on an "official" Microsoft repo: https://github.com/Microsoft/vscode-spell-check/issues/33 https://github.com/Microsoft/vscode-spell-check/issues/33
- timhaines 10y agoThere's a PM at Microsoft called Sean McBreen who works with Visual Studio. Probably the same guy. He's posted his email address publicly before - smcbreen@microsoft.com (i.e. here https://github.com/Armitxes/VSCode_SQF/issues/2 https://github.com/Armitxes/VSCode_SQF/issues/2 )
- samnewman 10y agoThanks Tim - I had just started trying to track Sean down, so this will help! Will update the post if I hear anything back from him.
- kogus 10y agoWhat does it take to get listed in the Visual Studio extensions dialog? If there is a review process, it should probably include a requirement that "transmitting your code across the wire" requires explicit consent each time, or something similar.
- btrask 10y agoWe could really use a decentralized spell checking service. I'm thinking a blockchain, maybe Ethereum. Edit: Poe's law.
- GuiA 10y agoPlease make a compelling case as to why a distributed solution is warranted for spell checking?
- samnewman 10y agoYup - this is my fundamental problem. HTTP or HTTPS isn't the issue - sending everything I open in my editor to a third party is the problem.
- jedberg 10y agoI don't actually think it should be, but I can make a compelling case. While it's possible to have a dictionary of all of the words of a language, it will always be missing the proper nouns. It will also be missing the data needed to take my very poor spelling and figure out what I'm trying to say. Combining these two problems, I've found that oftentimes my local spell checker can't figure out what I'm trying to say, but Google can figure it out no problem. I don't mind having to go to Google once in a while to do this manually, but that can is the case for a distributed spell check service.
- pkaye 10y agoDoesn't Google use a large corpus of documents along with machine learning/statistical analysis to do spelling and grammar checking? The same way they do language translation.
- tamana 10y agoYou are confusing index building with index lookup.
- deleted 10y ago[deleted]
- zerocrates 10y ago> This peaked my interest - who were the people behind this service? I just had to check, and am sad to report After the Deadline wouldn't have caught this error ("peaked" for "piqued") even if the author had still been using it. More relevantly, am I wrong in thinking that After the Deadline does actually support HTTPS? An HTTPS request [1] seems to work fine. The article muses on this point a little, but maybe it is just the "teacher" module at fault after all? [1] https://service.afterthedeadline.com/checkDocument?key=test-hn&data=sneak%20peak https://service.afterthedeadline.com/checkDocument?key=test-...
- samnewman 10y agoI'll update the post, thanks!
- rhizome 10y agoCould be, but even so that wouldn't fix the "throwing your IP into a black hole" problem.
- Houshalter 10y ago"Peaked" is such a common spelling of "piqued" that their dataset of English text probably contains many examples of it, and so doesn't recognize it as an error.
- userbinator 10y agothere is a rather large amount of traffic generated from my machine for things like Sonos and Dropbox and the like, but eventually I tracked down what was being sent. Sure enough I could see all the text being sent, unencrypted, over HTTP Another consequence of the "cloud everything" trend. I feel like it's almost a deliberate plan to make everyone's machines constantly send and receive data over dozens of active connections, so the odd one occasionally sending out something that shouldn't be will easily "get lost in the noise"... You could even say that at least this time they were nice enough to tell you and send data in cleartext so you can easily see what's going on. Imagine if it used HTTPS, added another layer of encryption/obfuscation on top of that, and the notice was buried deep in a long license agreement, how long would it take someone to discover it? What astounds me is that 20K(!) Visual Studio users --- so presumably NOT the "average barely-computer-literate" user we often like to think of as being the ones to get fooled by schemes like this --- probably saw the notice, but didn't give a second thought to installing something like this? These are developers, the people writing today's and tomorrow's software. That makes me sad and scared for the future of privacy/security. Then again, Microsoft's official Visual Studio privacy policy isn't all that much more reassuring: https://www.visualstudio.com/en-us/dn948229 https://www.visualstudio.com/en-us/dn948229 For pre-release and free versions of the software, users cannot opt out of usage data collection. Bluntly stated, "You're the product."
- samnewman 10y agoIt's probably worth pointing out that this is Visual Studio Code, rather than Visual Studio - the audience for the former is fairly small by comparison!
- milkey_mouse 10y agoWhat if I want to be the product? I could pay for Visual Studio Enterprise/Ultimate or whatever, or just accept that my usage is being tracked by MS. As long as they aren't being so egregious as to send the contents of my files, or sending over an unencrypted connection, I don't see why the makers of the product, offering it for free, can't track basic data.
- 10y ago
- jmspring 10y agoIf you are on OS X, buy and run Little Snitch. The connections for outbound requests are quite amazing.
- wingerlang 10y agoIt gets really annoying really fast though.
- fishanz 10y agoI agree. Run Charles Proxy on their free trial for 15 minutes with the OS X proxy turned on and find out what your Mac is really sending out and taking in. Then buy it because it's an incredible tool that proves extremely useful when debugging your own work!
- wingerlang 10y agoTechnically I think they are different beasts. Charles proxy is for, as you say, inspecting and debugging. Little snitch is for making a white/blacklist of connections. That being said I 100% agree that Charles is a fantastic application.
- voltagex_ 10y agoGetting offtopic here - if I wanted egress filtering at the router level, what could I add to my network that wouldn't force LAN traffic through the same port? OpenWRT isn't an option on my router because the 802.11AC radios aren't (and probably will never be) supported. Happy to add another {mips32,armv7} box to my network, though.
- wingerlang 10y agoI'd love to help you but this is not my area of expertise. (Just responding as you replied to me, hopefully someone else can chime in).
- 10y ago
- DominikR 10y agoI have finished a few projects as an external contractor for companies in the financial sector and many would be surprised how paranoid these companies are about the source code. Aside from the (sometimes insane) checks they have in place I've also had to sign a NDA. I doubt that the creator of this plugin had bad intentions, but using this plugin could cause some programmers to be dragged in front of a court. I believe the warning should be more visible.
- demarq 10y agoI think the post is an overreaction. The plug in author clearly stated the consequences of using his plug in. The blogger clearly wants to make this a scandelous "expose" but it just isn't because there is no effort to deceive anyone of anything. I also decided not to use the plug in a few weeks ago but was impressed that the author was open and transparent of its shortcomings. Labeling his efforts as "shocking" or "insane" is a tad over dramatic isn't it? Besides all this is on github. Fork pull and push your alternative then post it on HN. Done!
- meowface 10y agoIt's not at all obvious to 95% or more of the plugin users that this is just an API for a web service. I wouldn't say it's intentionally deceptive or anything, but it's not an appropriate amount of notice.
- gkya 10y agoI guess when one is considering to use a package they're supposed to read its README file. If they can't be bothered, well, that's their problem, even pages of notices won't help.
- michaelmrose 10y agoSome concepts have upsides and downsides such that notice may be required in order that the individual can make an informed decision and if they choose poorly it's on them. Some ideas like this one are so bad that they shouldn't exist at all on the premise that the idea of spell checking requiring sending all your documents over http is so bad that anyone that runs it must perforce either not know or not understand because understanding would lead any reasonable party not to install it. Therefore the addon exists only as a trap for the unwary or the stupid and makes the plugin ecosystem worse for existing and thus ought to be deleted.
- stronglikedan 10y agoIt's a clear and concise notice that both explains the issue, and warns about the implications, in less than three sentences. To me, it's perfectly appropriate. If you're in the 5%, then you're done grokking the notice, and you can move on however you choose. If you're in the 95%, then you have all of the keywords with which to do your due diligence before proceeding.
- jcoffland 10y agoThis cloud thing has gotten really ridiculous lately. I was at the Maker Faire recently and this guy at one of the booths was pontificating on the virtues of their 3D printing platform which ran in the cloud. Finally he finished with, "I'd love to give you a demo but we've been having trouble with the wifi all day." If I was drinking milk it would have shot out my nose.
- JustSomeNobody 10y agoAt least you weren't drinking the Kool-Aid.
- cwilkes 10y agoI'll give a reason why I would have chosen this route by way of example. A Hololens hackathon I went to had us using Unity and C sharp. Not knowing C sharp I still wanted to participate so I learned enough of it to be able to post to a python script in AWS where I could actually do some work. Could I have done that locally? Sure but I didn't know the language. I just wanted to get something done and it did the job pretty well. Maybe that applies in this situation? I don't know. Course what I was doing was for a throwaway project that I wasn't planning on releasing to the world.
- c_hackett 10y agoSo I spotted the same problem on 6th May 2016 and sent a PR (which was merged) to update the description shown in VS Code to "Detect mistakes as you type and suggest fixes using a web service" PR https://github.com/Microsoft/vscode-spell-check/pull/30 https://github.com/Microsoft/vscode-spell-check/pull/30 But it seems this was reverted in a more recent commit. #letTheConspiracyTheoriesBegin
- vmateixeira 10y agoThey reverted it 'by mistake'.
- seanmcb 10y agoThis was an oversight by me in a recent update - however -I've resolved it and with any luck made the statement even more visible for the users/anyone who does an update.
- dragandj 10y agoWait a minute. Microsoft did something to deceive the users of its "free" Visual Studio? Why this does not surprise me... I can understand why people used Visual Studio 20 years ago - decent free alternatives were lacking. But in 2016? And no less than for markdown!
- Hondor 10y agoWhat alternatives are there? Just recently there was a HN story about a great add-on for Emacs that would find the definition of a symbol. That's been in VS for a decade or two but open source editors apparently don't have it. Same goes for renaming things and having them automatically renamed everywhere else. Background compiler that underlines and even corrects your errors as you type - what else does that?
- kuschku 10y agoThe IntelliJ IDEA Open Source edition?
- wtbob 10y ago> Just recently there was a HN story about a great add-on for Emacs that would find the definition of a symbol. That's been in VS for a decade or two but open source editors apparently don't have it. ctags has existed since 1979, which is almost 40 years ago. The thing you read about implements a different way to find definitions.
- hurricaneSlider 10y ago1. It is a third party plugin. 2. VSCode is OSS 3. VSCode != VisualStudio. Conclusion: You clearly dislike Microsoft and hence confirmation bias has lead you to post an inflammatory comment without even reading the article.
- dragandj 10y agoHave you read the comments? Who is the author of that "3-rd party" plugin? No connections with Microsoft?
- ordbajsare 10y agoJava peopel....
- deleted 10y ago[deleted]
- labmice 10y agoWell.... Don't know if you already know about it... but After the Deadline was written by Raphael Mudge, the creator of Armitage and Cobalt Strike. See the 1st video on this site http://www.hick.org/~raffi/afterthedeadline.html http://www.hick.org/~raffi/afterthedeadline.html Also if you go to 02:40 he says that Hacker News is his favorite site. Inception...
- yAnonymous 10y agoThe plugin is managed by a Microsoft employee, but unlike other MS plugins, it has the author name instead of "Microsoft", which makes it even more suspicious. The description was changed to reflect that it uses a web service at one point, but the change was reverted. https://github.com/Microsoft/vscode-spell-check/pull/30 https://github.com/Microsoft/vscode-spell-check/pull/30 So no, the post is not overdramatic at all.
- MOARDONGZPLZ 10y agoI work for a large organization and make and manage personal programs all the time with absolutely no relationship to or input from my parent organization. Occasionally I am allowed put them on the Org's Github if they're useful and relevant to the mission. It's a cool little perk because it can give personal projects more visibility. I'm not saying it's not suspicious (I don't think it is though), but I don't think that a Microsoft employee creating their own plugin, even under Microsoft's Github, makes it suspicious.
- yAnonymous 10y agoAnd what about the secretly reverted plugin description? Must have been a weird accident.
- tombert 10y agoI kind of wonder why no one just forks the (Libre/Open)Office spell-checker and design a plugin around that. Doesn't that work totally fine offline?
- nanis 10y agoI guess a spell checker once again is a major feat of software engineering: http://prog21.dadgum.com/29.html http://prog21.dadgum.com/29.html
- trtr 10y agotremendous
- trtr 10y agotremendous
- SZJX 10y agoWell this seems to be an exaggeration. Does this plugin also send anything for non-text based files at all?