5 ms·

wtf are those guys doing, uploading source code without consent feels criminal, source code with app configs/secrets has ultra sensitive information. anybody h

wtf are those guys doing, uploading source code without consent feels criminal, source code with app configs/secrets has ultra sensitive information. anybody has a list of infected packages so others can quickly remove with `apm uninstall ...`?

koolba 9y ago
Well technically you did consent by clicking "Enable Kite". I'm not familiar with Kite but the linked image has a line that says, "Click here to learn more.". I'd wager that it eventually links to a page that explains that all your source will be uploaded to their servers. Now that doesn't make it any less shady though...
- danmaz74 9y ago
  Hiding a detail like this into a "read more" is uber-shady. They deserve all the backlash they're getting.
  - LaurentVB 9y ago
    Funny how I now read this as Uber-shady.
- 3pt14159 9y ago
  What they did is figuratively a felony (literally a "indictable offense") here in Canada. These guys are going to go to prison. Courts have ruled time and time again that hiding unreasonable or otherwise illegal actions in ToS does not absolve liability or criminality.
  - enzanki_ars 9y ago
    Just out of curiosity, what part of this is considered illegal? Not defending Kite here, but it seems that even though they are using some shady tactics to gain users, none of their product/ToS seems illegal.
    - efdee 9y ago
      Theft of copyrighted material, if bfirsh's claim of having the tool upload _all of the source code on his computer_ without asking about it. Maybe even corporate espionage.
      - jonathanstrange 9y ago
        > Theft of copyrighted material Copyright infringement is not theft. These are two completely different issues. When data is copied it is not taken away from the owner like when physical goods are stolen. Secondary damages may or may not occur, but they are not the same as depriving someone of a good. As an analogy, I wouldn't steal a car, but I surely would copy a car if I could do so by simply pressing a button...
        xg15 9y ago
        Both are punishable crimes though, so I don't see what difference the point makes
        Spoom 9y ago
        The primary difference is that copyright infringement is a civil offense, not a criminal one, so nobody would be "going to prison".
        will_brown 9y ago
        Copyright Infringement is an act, and at least here in the US, an act which both criminal and civil laws provides specific penalties/remedies. On the criminal side, obviously, one of the penalties is imprisonment.
        Spoom 9y ago
        Ah, I was unfamiliar with criminal penalties for copyright infringement. Could you go ahead and link me to the relevant US Code text that provides for such penalties?
- michaelmior 9y ago
  I don't really want to defend Kite, but when it says "Kite achieves this by analyzing your code in the cloud" I would assume that my code is uploaded to the cloud.
  - mrkrabo 9y ago
    If you're going to upload potentially private code from your user's computer to your servers, you better warn him with big fat red letters before you upload a single byte.
  - daxelrod 9y ago
    Which code is "my code" here? My assumption from that dialog box would be that at most, the code I currently have open in my editor would be uploaded. Not all the source code on my computer.
    - iainmerrick 9y ago
      How can autocomplete work without looking at all the other code too? Edit to add: oh, wait, I misunderstood. It grabs all the code on your computer? That's crazy. I just meant it's not totally unreasonable to grab the whole git repo you're working in, say.
      - keganunderwood 9y ago
        Yeah, screw kite.
    - sofaofthedamned 9y ago
      Exactly. How do they know what is my code, or somebody elses? Dodgy.
  - mercer 9y ago
    If you don't want to defend Kite, why bother defending Kite?
    - 9y ago
- Silhouette 9y ago
  This is why some data protection and privacy laws are starting to require active, informed consent before taking some actions, instead of merely specifying "consent". Even without that, basic contract law in many places requires a degree of mutual understanding for the contract to be valid in the first place. You can't just bury a surprising term with a huge effect deep inside a long legalese document and expect it to actually stand up in court, and if you're doing something dubious and relying on that as your defence then you might be in for some disappointment.
- freshhawk 9y ago
  Makes me imagine some angry and equally shady person might contribute to some open source projects that Kite uses internally. With a ToS addition giving them access to all available data on the company network if you are Kite. Obviously this would a be a terrible thing to do and no one should.
jacquesm 9y ago
It does not just feel criminal, it probably is. On top of that it might make you liable for reproducing some company code without permission. Very very bad idea.

koolba 9y ago

Well technically you did consent by clicking "Enable Kite". I'm not familiar with Kite but the linked image has a line that says, "Click here to learn more.". I'd wager that it eventually links to a page that explains that all your source will be uploaded to their servers. Now that doesn't make it any less shady though...

danmaz74 9y ago
Hiding a detail like this into a "read more" is uber-shady. They deserve all the backlash they're getting.
- LaurentVB 9y ago
  Funny how I now read this as Uber-shady.
3pt14159 9y ago
What they did is figuratively a felony (literally a "indictable offense") here in Canada. These guys are going to go to prison. Courts have ruled time and time again that hiding unreasonable or otherwise illegal actions in ToS does not absolve liability or criminality.
- enzanki_ars 9y ago
  Just out of curiosity, what part of this is considered illegal? Not defending Kite here, but it seems that even though they are using some shady tactics to gain users, none of their product/ToS seems illegal.
  - efdee 9y ago
    Theft of copyrighted material, if bfirsh's claim of having the tool upload _all of the source code on his computer_ without asking about it. Maybe even corporate espionage.
    - jonathanstrange 9y ago
      > Theft of copyrighted material Copyright infringement is not theft. These are two completely different issues. When data is copied it is not taken away from the owner like when physical goods are stolen. Secondary damages may or may not occur, but they are not the same as depriving someone of a good. As an analogy, I wouldn't steal a car, but I surely would copy a car if I could do so by simply pressing a button...
      - xg15 9y ago
        Both are punishable crimes though, so I don't see what difference the point makes
        Spoom 9y ago
        The primary difference is that copyright infringement is a civil offense, not a criminal one, so nobody would be "going to prison".
        will_brown 9y ago
        Copyright Infringement is an act, and at least here in the US, an act which both criminal and civil laws provides specific penalties/remedies. On the criminal side, obviously, one of the penalties is imprisonment.
        Spoom 9y ago
        Ah, I was unfamiliar with criminal penalties for copyright infringement. Could you go ahead and link me to the relevant US Code text that provides for such penalties?
michaelmior 9y ago
I don't really want to defend Kite, but when it says "Kite achieves this by analyzing your code in the cloud" I would assume that my code is uploaded to the cloud.
- mrkrabo 9y ago
  If you're going to upload potentially private code from your user's computer to your servers, you better warn him with big fat red letters before you upload a single byte.
- daxelrod 9y ago
  Which code is "my code" here? My assumption from that dialog box would be that at most, the code I currently have open in my editor would be uploaded. Not all the source code on my computer.
  - iainmerrick 9y ago
    How can autocomplete work without looking at all the other code too? Edit to add: oh, wait, I misunderstood. It grabs all the code on your computer? That's crazy. I just meant it's not totally unreasonable to grab the whole git repo you're working in, say.
    - keganunderwood 9y ago
      Yeah, screw kite.
  - sofaofthedamned 9y ago
    Exactly. How do they know what is my code, or somebody elses? Dodgy.
- mercer 9y ago
  If you don't want to defend Kite, why bother defending Kite?
  - 9y ago
Silhouette 9y ago
This is why some data protection and privacy laws are starting to require active, informed consent before taking some actions, instead of merely specifying "consent". Even without that, basic contract law in many places requires a degree of mutual understanding for the contract to be valid in the first place. You can't just bury a surprising term with a huge effect deep inside a long legalese document and expect it to actually stand up in court, and if you're doing something dubious and relying on that as your defence then you might be in for some disappointment.
freshhawk 9y ago
Makes me imagine some angry and equally shady person might contribute to some open source projects that Kite uses internally. With a ToS addition giving them access to all available data on the company network if you are Kite. Obviously this would a be a terrible thing to do and no one should.

jacquesm 9y ago

It does not just feel criminal, it probably is. On top of that it might make you liable for reproducing some company code without permission. Very very bad idea.