7 ms·

I think the post is an overreaction. The plug in author clearly stated the consequences of using his plug in. The blogger clearly wants to make this a scandelo

by demarq 10y ago

I think the post is an overreaction. The plug in author clearly stated the consequences of using his plug in. The blogger clearly wants to make this a scandelous "expose" but it just isn't because there is no effort to deceive anyone of anything. I also decided not to use the plug in a few weeks ago but was impressed that the author was open and transparent of its shortcomings. Labeling his efforts as "shocking" or "insane" is a tad over dramatic isn't it? Besides all this is on github. Fork pull and push your alternative then post it on HN. Done!

meowface 10y ago
It's not at all obvious to 95% or more of the plugin users that this is just an API for a web service. I wouldn't say it's intentionally deceptive or anything, but it's not an appropriate amount of notice.
- gkya 10y ago
  I guess when one is considering to use a package they're supposed to read its README file. If they can't be bothered, well, that's their problem, even pages of notices won't help.
  - michaelmrose 10y ago
    Some concepts have upsides and downsides such that notice may be required in order that the individual can make an informed decision and if they choose poorly it's on them. Some ideas like this one are so bad that they shouldn't exist at all on the premise that the idea of spell checking requiring sending all your documents over http is so bad that anyone that runs it must perforce either not know or not understand because understanding would lead any reasonable party not to install it. Therefore the addon exists only as a trap for the unwary or the stupid and makes the plugin ecosystem worse for existing and thus ought to be deleted.
- stronglikedan 10y ago
  It's a clear and concise notice that both explains the issue, and warns about the implications, in less than three sentences. To me, it's perfectly appropriate. If you're in the 5%, then you're done grokking the notice, and you can move on however you choose. If you're in the 95%, then you have all of the keywords with which to do your due diligence before proceeding.
kome 10y ago
> I think the post is an overreaction. Thank you for writing this! By reading the article I had exactly the same feeling. The author of the extension was open and clear, the author of the post need to keep this anger for secret but explicit surveillance programs, not optional online spellcheckers...
iopq 10y ago
Why a plug-in has to send everything through the web instead of just having a dictionary is beyond me.
- andrepd 10y ago
  Jesus, it doesn't. So go fork it and change that! It doesn't mean other people aren't free to design their plugin as they see fit.
- andreareina 10y ago
  Because it's more time and effort to make a service that checks spelling (are you accounting for stems? Possessives? Other uses of the single quote such as contractions?) and suggests corrections than to wrap an already-existing service that does the same. I find it highly plausible that the author of the plug-in wrote it to solve their needs and just made it available because hey, it doesn't cost them anything.
  - yAnonymous 10y ago
    I want to believe, but https://news.ycombinator.com/item?id=11805189 https://news.ycombinator.com/item?id=11805189 Instant uninstall. This is exactly the kind of crap I expected when MS announced they'd invest in open source.
- deleted 10y ago
  [deleted]
- Houshalter 10y ago
  I've found local spellcheckers really unreliable. They never catch obscure or niche words, or grammar. Chrome has an option to ask google for spelling suggestions and it makes it much more reliable.
bobbles 10y ago
Yeah really, it just means now maybe people will have more options. You can choose an easy simple not-private way of doing things, or you can do things in a private way. Being up front about it is 100% the only way to manage this properly so what else can be done? It's not like we should suddenly not make useful tools because they dont use end to end encryption on everything, not every action needs that level of protection, but some do.
belorn 10y ago
A lot of people sign NDA's when they work as a programmer. Installing a spell-checker and accidentally break ones nda's seems as a valid surprise. That and passwords in wp-config and similar files being commented out occasionally make me actively avoid cloud solutions for spell checking.
- dspillett 10y ago
  > Installing a spell-checker and accidentally break ones nda's seems as a valid surprise. No, that is a shocking lack of due diligence IMO. Seriously, if we as developers can't be trusted not to install random junk without checking the consequences how do we expect the user-on-the-street to stop installing malware because they just have to take that "what Disney character's left testicle are you most likely find in your coffee tomorrow" quiz?!
  - DominikR 10y ago
    I've done projects with NDA for the Android platform where using Android Studio today is almost mandatory. After reading this post I remembered that Android Studio already has some kind of spell checking active by default and to be honest I didn't read the complete source code of Android Studio and all packages that are shipped with it by default, who does that? Maybe you do, but who is going to pay you for completing that task (as a programmer) and reviewing every single update in the future.
    - ajoy39 10y ago
      There is a wide gulf of difference between installing an IDE from a trusted corporate entity who would be sued if they did this kind of thing by default without warning vs. installing a 3rd party open source plugin from a developer you've never heard of without reading the description.
      - DominikR 10y ago
        There is a difference but it doesn't change anything for me as a contractor. I'd imagine suing Google or Apple would be no fun when I'm sued by some bank for a breach of NDA. As a software dev we ideally should keep in mind for what kind of target audience we are developing our tools, and in this case it is obvious that this tool would be a problem for many if not most companies for security reasons. Is there even a reason why anyone would want to have all his source code sent to some unknown third party? Or why this would be necessary for something like spell checking? I doubt that the dev has bad intentions with this plugin, but imho this tool is badly designed and unusable. Doesn't matter how visible this information is, there are no justifications I can think of why I should allow my source code to be sent to a third party.
IshKebab 10y ago
> The plug in author clearly stated the consequences of using his plug in. Only if you happen to read the readme, right? It doesn't pop up a warning when you install it (if it did I think that would be fine).
jakobegger 10y ago
If the plugin author was really honest, he'd mention the fact that this spell checker is web based in the title or at the top of the description, where people actually read it. Nobody would complain if this was called the "Web Based Spell Checker" or "After The Deadline Spell Checker".
- drdaeman 10y ago
  Ahem. From the article: "But then, at the top of the description, I found this message greeting me: [...]" It's this way on the linked extension's page as well: https://marketplace.visualstudio.com/items?itemName=seanmcbreen.Spell https://marketplace.visualstudio.com/items?itemName=seanmcbr... I think that's fairly prominent place and the only explanation for installing this extension could be either that it's acceptable - for example if one's using MSVSC to edit Wikipedia articles or something like that - or negligence to read anything but the title (which can't be helped). (Well, author could've put "[INSECURE!!!! WILL STEAL YOUR CODEZ!!!!1one]" in the title... but should he?)
  - ajoy39 10y ago
    Apparently asking people to read the descriptions of plugins they are installing is too much effort
  - jakobegger 10y ago
    Look at the package file: https://github.com/Microsoft/vscode-spell-check/blob/master/package.json https://github.com/Microsoft/vscode-spell-check/blob/master/... The description, which is the only part visible in the search interface, contains no mention that this uses a web service. See this comment how it should be done correctly: https://news.ycombinator.com/item?id=11805189 https://news.ycombinator.com/item?id=11805189
    - BuildTheRobots 10y ago
      Interestingly it's just had a version bump which makes the description a lot more obvious: "Uses a web service to detect mistakes and suggest fixes - great for Markdown or any text file." https://github.com/Microsoft/vscode-spell-check/commit/70847032da107940fd86b354c5c66be3a2399317 https://github.com/Microsoft/vscode-spell-check/commit/70847...
kelnos 10y ago
I don't think it's an overreaction at all. Simply building the extension with those shortcomings, regardless of the documentation, was a terrible, irresponsible idea.
voltagex_ 10y ago
Fixed - at least in the teacher upstream source.
dogma1138 10y ago
I agree, also considering that virtually every spell checker these days uses an online API rather than offline dictionary + semantic grammar rule checks you shouldn't use any of those for sensitive documents regardless of them using HTTPS or not.

by demarq 10y ago

meowface 10y ago

It's not at all obvious to 95% or more of the plugin users that this is just an API for a web service. I wouldn't say it's intentionally deceptive or anything, but it's not an appropriate amount of notice.

gkya 10y ago
I guess when one is considering to use a package they're supposed to read its README file. If they can't be bothered, well, that's their problem, even pages of notices won't help.
- michaelmrose 10y ago
  Some concepts have upsides and downsides such that notice may be required in order that the individual can make an informed decision and if they choose poorly it's on them. Some ideas like this one are so bad that they shouldn't exist at all on the premise that the idea of spell checking requiring sending all your documents over http is so bad that anyone that runs it must perforce either not know or not understand because understanding would lead any reasonable party not to install it. Therefore the addon exists only as a trap for the unwary or the stupid and makes the plugin ecosystem worse for existing and thus ought to be deleted.
stronglikedan 10y ago
It's a clear and concise notice that both explains the issue, and warns about the implications, in less than three sentences. To me, it's perfectly appropriate. If you're in the 5%, then you're done grokking the notice, and you can move on however you choose. If you're in the 95%, then you have all of the keywords with which to do your due diligence before proceeding.

kome 10y ago

> I think the post is an overreaction. Thank you for writing this! By reading the article I had exactly the same feeling. The author of the extension was open and clear, the author of the post need to keep this anger for secret but explicit surveillance programs, not optional online spellcheckers...

iopq 10y ago

Why a plug-in has to send everything through the web instead of just having a dictionary is beyond me.

andrepd 10y ago
Jesus, it doesn't. So go fork it and change that! It doesn't mean other people aren't free to design their plugin as they see fit.
andreareina 10y ago
Because it's more time and effort to make a service that checks spelling (are you accounting for stems? Possessives? Other uses of the single quote such as contractions?) and suggests corrections than to wrap an already-existing service that does the same. I find it highly plausible that the author of the plug-in wrote it to solve their needs and just made it available because hey, it doesn't cost them anything.
- yAnonymous 10y ago
  I want to believe, but https://news.ycombinator.com/item?id=11805189 https://news.ycombinator.com/item?id=11805189 Instant uninstall. This is exactly the kind of crap I expected when MS announced they'd invest in open source.
deleted 10y ago
[deleted]
Houshalter 10y ago
I've found local spellcheckers really unreliable. They never catch obscure or niche words, or grammar. Chrome has an option to ask google for spelling suggestions and it makes it much more reliable.

bobbles 10y ago

Yeah really, it just means now maybe people will have more options. You can choose an easy simple not-private way of doing things, or you can do things in a private way. Being up front about it is 100% the only way to manage this properly so what else can be done? It's not like we should suddenly not make useful tools because they dont use end to end encryption on everything, not every action needs that level of protection, but some do.

belorn 10y ago

A lot of people sign NDA's when they work as a programmer. Installing a spell-checker and accidentally break ones nda's seems as a valid surprise. That and passwords in wp-config and similar files being commented out occasionally make me actively avoid cloud solutions for spell checking.

dspillett 10y ago
> Installing a spell-checker and accidentally break ones nda's seems as a valid surprise. No, that is a shocking lack of due diligence IMO. Seriously, if we as developers can't be trusted not to install random junk without checking the consequences how do we expect the user-on-the-street to stop installing malware because they just have to take that "what Disney character's left testicle are you most likely find in your coffee tomorrow" quiz?!
- DominikR 10y ago
  I've done projects with NDA for the Android platform where using Android Studio today is almost mandatory. After reading this post I remembered that Android Studio already has some kind of spell checking active by default and to be honest I didn't read the complete source code of Android Studio and all packages that are shipped with it by default, who does that? Maybe you do, but who is going to pay you for completing that task (as a programmer) and reviewing every single update in the future.
  - ajoy39 10y ago
    There is a wide gulf of difference between installing an IDE from a trusted corporate entity who would be sued if they did this kind of thing by default without warning vs. installing a 3rd party open source plugin from a developer you've never heard of without reading the description.
    - DominikR 10y ago
      There is a difference but it doesn't change anything for me as a contractor. I'd imagine suing Google or Apple would be no fun when I'm sued by some bank for a breach of NDA. As a software dev we ideally should keep in mind for what kind of target audience we are developing our tools, and in this case it is obvious that this tool would be a problem for many if not most companies for security reasons. Is there even a reason why anyone would want to have all his source code sent to some unknown third party? Or why this would be necessary for something like spell checking? I doubt that the dev has bad intentions with this plugin, but imho this tool is badly designed and unusable. Doesn't matter how visible this information is, there are no justifications I can think of why I should allow my source code to be sent to a third party.

IshKebab 10y ago

> The plug in author clearly stated the consequences of using his plug in. Only if you happen to read the readme, right? It doesn't pop up a warning when you install it (if it did I think that would be fine).

jakobegger 10y ago

If the plugin author was really honest, he'd mention the fact that this spell checker is web based in the title or at the top of the description, where people actually read it. Nobody would complain if this was called the "Web Based Spell Checker" or "After The Deadline Spell Checker".

drdaeman 10y ago
Ahem. From the article: "But then, at the top of the description, I found this message greeting me: [...]" It's this way on the linked extension's page as well: https://marketplace.visualstudio.com/items?itemName=seanmcbreen.Spell https://marketplace.visualstudio.com/items?itemName=seanmcbr... I think that's fairly prominent place and the only explanation for installing this extension could be either that it's acceptable - for example if one's using MSVSC to edit Wikipedia articles or something like that - or negligence to read anything but the title (which can't be helped). (Well, author could've put "[INSECURE!!!! WILL STEAL YOUR CODEZ!!!!1one]" in the title... but should he?)
- ajoy39 10y ago
  Apparently asking people to read the descriptions of plugins they are installing is too much effort
- jakobegger 10y ago
  Look at the package file: https://github.com/Microsoft/vscode-spell-check/blob/master/package.json https://github.com/Microsoft/vscode-spell-check/blob/master/... The description, which is the only part visible in the search interface, contains no mention that this uses a web service. See this comment how it should be done correctly: https://news.ycombinator.com/item?id=11805189 https://news.ycombinator.com/item?id=11805189
  - BuildTheRobots 10y ago
    Interestingly it's just had a version bump which makes the description a lot more obvious: "Uses a web service to detect mistakes and suggest fixes - great for Markdown or any text file." https://github.com/Microsoft/vscode-spell-check/commit/70847032da107940fd86b354c5c66be3a2399317 https://github.com/Microsoft/vscode-spell-check/commit/70847...

kelnos 10y ago

I don't think it's an overreaction at all. Simply building the extension with those shortcomings, regardless of the documentation, was a terrible, irresponsible idea.

voltagex_ 10y ago

Fixed - at least in the teacher upstream source.

dogma1138 10y ago

I agree, also considering that virtually every spell checker these days uses an online API rather than offline dictionary + semantic grammar rule checks you shouldn't use any of those for sensitive documents regardless of them using HTTPS or not.