5 ms·

An apology that starts with 4 paragraphs of self-congratulation is not a real apology at all. Nothing of the article reads as being genuinely regretful of the s

An apology that starts with 4 paragraphs of self-congratulation is not a real apology at all. Nothing of the article reads as being genuinely regretful of the strategies taken - it's just sorry for being caught. >Unfortunately, while trying to make programmers’ lives a little less complicated, we instead made them more complicated. Barely an admission of guilt, and even that can't get past without patting themselves on the back for the noble cause they 're profitably working towards. Yes, Kite, your pay-for service clearly has my best interests in mind. I forgive you for being too stupid to grasp your superior approach. How about actually finding fault with hijacking projects for advertising in the first place?

fooey 9y ago
Buying a popular addon with the express purpose of subverting its original intent for commercial monetization seems like it should be against Atom's TOS This instance is razor thin close to being malware What's to stop the next enterprising company from intentionally uploading all your code to their servers? Modifying your code? Or holding your code hostage? Atom has git support backed in, so how likely is it an addon could inject code and commit it without you ever seeing that it happened. Atom's automagic update approach to addons can't survive this kind of exploitation. If I have to re-vet every addon every time there's an update, their entire ecosystem just turned to shit. Do we need virus scanners for Atom packages now? An addon that scans repos to see if the primary contributor suddenly changed?
- codezero 9y ago
  Picking nits I think you mean adware not malware. I think it's worth making the distinction.
  - emsy 9y ago
    Giving ad networks tracking information of your editor usage and possibly access to the code you're working (which they didn't do, but the original statement was 'close to being malware') on is beyond mere adware.
    - codezero 9y ago
      Adware always had telemetry. But I get your point. Let's call it spyware then if we think companies might use our source as a consequence. I find it highly unlikely but admit it is possible.
  - davidgerard 9y ago
    Literally the only distinction is how many lawyers they're packing.
- danso 9y ago
  Maybe Github should have an informal policy that punishes bad actors by penalizing how they're listed in Atom's built-in package browser. Or create a convention of documentation that is machine-readable and easy to preview in the editor's package-updater tool. But making blanket rules regarding commercialization would likely have unwanted unintended effects. FWIW, Atom's community manager wrote a long comment in one of the Kite plugins' Github issues: https://github.com/atom-minimap/minimap/issues/588#issuecomment-300600495 https://github.com/atom-minimap/minimap/issues/588#issuecomm... > As a steward of the Atom editor and the Atom package ecosystem, I'm of course concerned about packages being used for nefarious purposes. But I'm also loathe to impose blanket rules on what is or isn't valid functionality for packages without some very well-thought-out rationalization and justification for those rules. I've been watching this topic hoping that the smart people here would give me some ideas > [an analogy to the value of advertising in other contexts] > ...I'm definitely keeping my eye on this kind of thing and if advertisements become a problem, I'm sure that the Atom team will consider specific rules. I just don't think we're there yet.
  - fooey 9y ago
    For starters, packages should probably be considered non-transferable. If someone buys a package, they shouldn't keep the existing rankings and ratings. It would be challenging to be proactive about it, but it was be a clear solution when they get caught.
- jdiaz5513 9y ago
  I think what it really means is this: If I'm the maintainer of an OSS plugin with 3m users, I'd better be _very_ careful about what I do with it, and keep my SSH keys, etc., _safe_. It's a responsibility not to be taken lightly. Practically speaking, it means you have to be comfortable with knowing you have a (tiny?) chance of being hit with a remote code exploit at any time. Avoiding that means disabling auto update and other such conveniences. Personally, I treat developer computers as untrusted by default.
dmix 9y ago
Eh I didn't get the "sorry for being caught" vibe. They admitted they failed to listen to early customer feedback. But still it sounded like a marketing piece as much as an apology, which is bad because authenticity is everything after a PR blowup like this. Repeatedly highlighting their open source creds didn't make me want to trust them more, it made me question how they didn't know it was a bad idea in the first place... and if business people were the ones making the calls instead of the OSS developers. This was a risky thing to do, even despite the luxury of looking back in retrospect, this seems like something you have to do very carefully if you are going to integrate ≈remote cloud services into text editor plugins, let alone commercial backed features. Clearly there was going to be a wide gap between the users expectations of a static local OSS plugin (as they almost always are) and what they changed it to. It had to be handled very carefully - if at all. They should have made a separate add-on plugin IMO and pushed it via the documentation of other plugins they own...
conradk 9y ago
The 2nd sentence is an apology: "Over the last few days, Kite has been knocked around in social media (and the actual media) over several moves we made to expand our user base. It was a humbling experience, and I’d like to apologize to the entire open source community for our handling of these projects."
- DrScump 9y ago
  It seems to me that even this apology is for how the deed was publicized, not that they regret doing it at all.
mustacheemperor 9y ago
The completely unpenitent doublespeak eliminated any remaining faith I had in this company's ethics. At the start of this controversy I thought it was at least possible the founders somehow just didn't think through the decision adequately, but they aren't willing to accept and apologize for reality.

fooey 9y ago

Buying a popular addon with the express purpose of subverting its original intent for commercial monetization seems like it should be against Atom's TOS This instance is razor thin close to being malware What's to stop the next enterprising company from intentionally uploading all your code to their servers? Modifying your code? Or holding your code hostage? Atom has git support backed in, so how likely is it an addon could inject code and commit it without you ever seeing that it happened. Atom's automagic update approach to addons can't survive this kind of exploitation. If I have to re-vet every addon every time there's an update, their entire ecosystem just turned to shit. Do we need virus scanners for Atom packages now? An addon that scans repos to see if the primary contributor suddenly changed?

codezero 9y ago
Picking nits I think you mean adware not malware. I think it's worth making the distinction.
- emsy 9y ago
  Giving ad networks tracking information of your editor usage and possibly access to the code you're working (which they didn't do, but the original statement was 'close to being malware') on is beyond mere adware.
  - codezero 9y ago
    Adware always had telemetry. But I get your point. Let's call it spyware then if we think companies might use our source as a consequence. I find it highly unlikely but admit it is possible.
- davidgerard 9y ago
  Literally the only distinction is how many lawyers they're packing.
danso 9y ago
Maybe Github should have an informal policy that punishes bad actors by penalizing how they're listed in Atom's built-in package browser. Or create a convention of documentation that is machine-readable and easy to preview in the editor's package-updater tool. But making blanket rules regarding commercialization would likely have unwanted unintended effects. FWIW, Atom's community manager wrote a long comment in one of the Kite plugins' Github issues: https://github.com/atom-minimap/minimap/issues/588#issuecomment-300600495 https://github.com/atom-minimap/minimap/issues/588#issuecomm... > As a steward of the Atom editor and the Atom package ecosystem, I'm of course concerned about packages being used for nefarious purposes. But I'm also loathe to impose blanket rules on what is or isn't valid functionality for packages without some very well-thought-out rationalization and justification for those rules. I've been watching this topic hoping that the smart people here would give me some ideas > [an analogy to the value of advertising in other contexts] > ...I'm definitely keeping my eye on this kind of thing and if advertisements become a problem, I'm sure that the Atom team will consider specific rules. I just don't think we're there yet.
- fooey 9y ago
  For starters, packages should probably be considered non-transferable. If someone buys a package, they shouldn't keep the existing rankings and ratings. It would be challenging to be proactive about it, but it was be a clear solution when they get caught.
jdiaz5513 9y ago
I think what it really means is this: If I'm the maintainer of an OSS plugin with 3m users, I'd better be _very_ careful about what I do with it, and keep my SSH keys, etc., _safe_. It's a responsibility not to be taken lightly. Practically speaking, it means you have to be comfortable with knowing you have a (tiny?) chance of being hit with a remote code exploit at any time. Avoiding that means disabling auto update and other such conveniences. Personally, I treat developer computers as untrusted by default.

dmix 9y ago

Eh I didn't get the "sorry for being caught" vibe. They admitted they failed to listen to early customer feedback. But still it sounded like a marketing piece as much as an apology, which is bad because authenticity is everything after a PR blowup like this. Repeatedly highlighting their open source creds didn't make me want to trust them more, it made me question how they didn't know it was a bad idea in the first place... and if business people were the ones making the calls instead of the OSS developers. This was a risky thing to do, even despite the luxury of looking back in retrospect, this seems like something you have to do very carefully if you are going to integrate ≈remote cloud services into text editor plugins, let alone commercial backed features. Clearly there was going to be a wide gap between the users expectations of a static local OSS plugin (as they almost always are) and what they changed it to. It had to be handled very carefully - if at all. They should have made a separate add-on plugin IMO and pushed it via the documentation of other plugins they own...

conradk 9y ago

The 2nd sentence is an apology: "Over the last few days, Kite has been knocked around in social media (and the actual media) over several moves we made to expand our user base. It was a humbling experience, and I’d like to apologize to the entire open source community for our handling of these projects."

DrScump 9y ago
It seems to me that even this apology is for how the deed was publicized, not that they regret doing it at all.

mustacheemperor 9y ago

The completely unpenitent doublespeak eliminated any remaining faith I had in this company's ethics. At the start of this controversy I thought it was at least possible the founders somehow just didn't think through the decision adequately, but they aren't willing to accept and apologize for reality.