4 ms·

> your software will automatically update to the full released version at no additional charge. So, give your proprietary software both network access and acce

> your software will automatically update to the full released version at no additional charge. So, give your proprietary software both network access and access to all my source code? I have very few complaints about the Jedi autocomplete library, which is neither proprietary nor requires network access. I welcome innovation in dev tools, but I wish you had found a monetization strategy that didn't require us to trust you so completely.

jacob-jackson 8y ago
Your concerns are understandable. It is about as risky as installing an editor plugin which updates automatically. The private keys used to sign releases are kept offline and would not be available to an attacker even if they compromised my online accounts. Finally, TabNine will work correctly if you deny it network access (say, by blacklisting update.tabnine.com).
- asdkhadsj 8y ago
  Wait, is the auto-update all that's needed for network? I assumed it was license validation or something. If it's just updating, couldn't you provide a different method of updating like manual update checking, and then peoples concerns would be solved?
  - itdaniher 8y ago
    No, it does use the network to validate registration keys. Presumably this means a TLS connection per invocation of the binary. > TabNine makes web requests only for the purposes of downloading updates and validating registration keys. from https://tabnine.com/faq https://tabnine.com/faq
- itdaniher 8y ago
  ...as risky as installing a proprietary editor plugin which updates automatically, yes. Also, AFAIK most understandings of MIT, BSD, and Apache 2.0 licenses require you to acknowledge the copyright holders of the source code you compile into your binary, even if the licenses permit binary distribution. I can't find your "Copyright (c) 2018 Tokio Contributors" or "Copyright (c) 2014 The Rust Project Developers" that I'd expect based on `strings TabNine | grep github`. Maybe you've got a lawyer that suggests otherwise? Your plea of "trust me, I have good hygiene" carries less weight when I have to `strings` your stuff to know what shoulders of which giants you're standing on.
  - stevew20 8y ago
    Same.
  - eridius 8y ago
    As risky as ones that don't update automatically either. Just because a plugin doesn't update automatically doesn't mean it doesn't still have the capability of doing network access. Unless you're actually sandboxing all your IDE plugins and denying most of them network access (and verifying on every new IDE plugin you install whether it's allowed network access), but I don't believe that's how IDE plugins generally work.
  - JimDabell 8y ago
    > ...as risky as installing a proprietary editor plugin which updates automatically, yes. Can't you make the same complaint about any auto-update functionality in any software? Even if it's BSD licensed, you're still counting on whomever has authority to push an update to not push malicious code. This doesn't seem to have anything to do with the fact that his code is proprietary nor his monetisation strategy, so why are you singling him out for those?
    - itdaniher 8y ago
      Proprietary - Can't patch out the autoupdate, which I might be tempted to do if something else in my toolchain did things at someone else's leisure. DRM/monetisation - the product as of my comment didn't seem to acknowledge the open source works compiled into the binary, and I didn't think that was a good look for someone with the authority to push out malicious code.
  - cyphar 8y ago
    MIT only requires source attribution. It's the BSD licenses that require attribution for binary forms of redistribution. Still, it is good manners and good cover-your-arse practice to attribute whatever free software work they used (Google does this with their giant "open source licenses" page).
    - 8y ago
- dharmab 8y ago
  Does the Vim version autoupdate? I'd rather it wait for me to run my plugin manager- I specifically don't want anything on my machine to update when I'm on-call or traveling.
- half0wl 8y ago
  > Finally, TabNine will work correctly if you deny it network access (say, by blacklisting update.tabnine.com). Just to clarify - would it still work if I deny network acess for the TabNine binary, _after_ validating my license key? Or is the key validation invoked on every launch (hence requiring network access)?
  - jacob-jackson 8y ago
    Yes, it will still work. (License key validation requests go to tabnine.com, so you should blacklist that too if you want to deny all network access.)
    - half0wl 8y ago
      Thanks! Purchased a copy :)
asdkhadsj 8y ago
I agree with your concerns - I wonder what could be written to alleviate them? This brings up an interesting problem. Ie, could we write a monitoring proxy where if enabled, all traffic goes through this proxy. This proxy enables the end user to monitor 100% of traffic, all http requests, and could even have a secondary documentation flow that explains the I/O for security minded individuals. Then you'd shut off remote network access to the binary, monitor all traffic, and feel secure knowing that it's only sending what it says it's sending, and why. With that said, I imagine you could do the same thing with a sniffer. Perhaps a documentation standard could be built into request/responses, so a monitoring program like Wireshark could snuff the I/O and see what it is. Do you have any thoughts on how someone could both network-license, and make you feel secure in their I/O? Ie, no trust needed?
- itdaniher 8y ago
  I don't think a DRM solution that is both robust against an adversary and inspectable by a stakeholder can be engineered. Software can't look out for both the person running it and the person selling it simultaneously when their needs are mutually exclusive. Cory Doctorow has some eloquent content on the topic, ie at [0]. In this particular case, the use of TLS (good!) makes it relatively challenging to inspect. Assuming the author isn't shipping a cert in his binary (doesn't look like it) - I'd have to spinup a new VM, load a custom root cert, and mess with a TLS terminating proxy / forwarding solution, and hope he's not using a secondary stream cipher on top of TLS. Maybe I get lucky and https://mitmproxy.org/ https://mitmproxy.org/ or something just works out of the box. In any case, lots of effort to know he's not siphoning up all the source code on the local machine and using it to train v2 of his project. And the more robust the DRM solution, the less feasible it is to inspect. [0] https://github.com/jwise/28c3-doctorow/blob/master/transcript.md https://github.com/jwise/28c3-doctorow/blob/master/transcrip...
  - achamayou 8y ago
    If the amount of traffic is predictably small though, you can be confident that it’s not uploading the entirety of your source code, so perhaps some mechanism to estqblish that would help?

jacob-jackson 8y ago

Your concerns are understandable. It is about as risky as installing an editor plugin which updates automatically. The private keys used to sign releases are kept offline and would not be available to an attacker even if they compromised my online accounts. Finally, TabNine will work correctly if you deny it network access (say, by blacklisting update.tabnine.com).

asdkhadsj 8y ago
Wait, is the auto-update all that's needed for network? I assumed it was license validation or something. If it's just updating, couldn't you provide a different method of updating like manual update checking, and then peoples concerns would be solved?
- itdaniher 8y ago
  No, it does use the network to validate registration keys. Presumably this means a TLS connection per invocation of the binary. > TabNine makes web requests only for the purposes of downloading updates and validating registration keys. from https://tabnine.com/faq https://tabnine.com/faq
itdaniher 8y ago
...as risky as installing a proprietary editor plugin which updates automatically, yes. Also, AFAIK most understandings of MIT, BSD, and Apache 2.0 licenses require you to acknowledge the copyright holders of the source code you compile into your binary, even if the licenses permit binary distribution. I can't find your "Copyright (c) 2018 Tokio Contributors" or "Copyright (c) 2014 The Rust Project Developers" that I'd expect based on `strings TabNine | grep github`. Maybe you've got a lawyer that suggests otherwise? Your plea of "trust me, I have good hygiene" carries less weight when I have to `strings` your stuff to know what shoulders of which giants you're standing on.
- stevew20 8y ago
  Same.
- eridius 8y ago
  As risky as ones that don't update automatically either. Just because a plugin doesn't update automatically doesn't mean it doesn't still have the capability of doing network access. Unless you're actually sandboxing all your IDE plugins and denying most of them network access (and verifying on every new IDE plugin you install whether it's allowed network access), but I don't believe that's how IDE plugins generally work.
- JimDabell 8y ago
  > ...as risky as installing a proprietary editor plugin which updates automatically, yes. Can't you make the same complaint about any auto-update functionality in any software? Even if it's BSD licensed, you're still counting on whomever has authority to push an update to not push malicious code. This doesn't seem to have anything to do with the fact that his code is proprietary nor his monetisation strategy, so why are you singling him out for those?
  - itdaniher 8y ago
    Proprietary - Can't patch out the autoupdate, which I might be tempted to do if something else in my toolchain did things at someone else's leisure. DRM/monetisation - the product as of my comment didn't seem to acknowledge the open source works compiled into the binary, and I didn't think that was a good look for someone with the authority to push out malicious code.
- cyphar 8y ago
  MIT only requires source attribution. It's the BSD licenses that require attribution for binary forms of redistribution. Still, it is good manners and good cover-your-arse practice to attribute whatever free software work they used (Google does this with their giant "open source licenses" page).
  - 8y ago
dharmab 8y ago
Does the Vim version autoupdate? I'd rather it wait for me to run my plugin manager- I specifically don't want anything on my machine to update when I'm on-call or traveling.
half0wl 8y ago
> Finally, TabNine will work correctly if you deny it network access (say, by blacklisting update.tabnine.com). Just to clarify - would it still work if I deny network acess for the TabNine binary, _after_ validating my license key? Or is the key validation invoked on every launch (hence requiring network access)?
- jacob-jackson 8y ago
  Yes, it will still work. (License key validation requests go to tabnine.com, so you should blacklist that too if you want to deny all network access.)
  - half0wl 8y ago
    Thanks! Purchased a copy :)

asdkhadsj 8y ago

I agree with your concerns - I wonder what could be written to alleviate them? This brings up an interesting problem. Ie, could we write a monitoring proxy where if enabled, all traffic goes through this proxy. This proxy enables the end user to monitor 100% of traffic, all http requests, and could even have a secondary documentation flow that explains the I/O for security minded individuals. Then you'd shut off remote network access to the binary, monitor all traffic, and feel secure knowing that it's only sending what it says it's sending, and why. With that said, I imagine you could do the same thing with a sniffer. Perhaps a documentation standard could be built into request/responses, so a monitoring program like Wireshark could snuff the I/O and see what it is. Do you have any thoughts on how someone could both network-license, and make you feel secure in their I/O? Ie, no trust needed?

itdaniher 8y ago
I don't think a DRM solution that is both robust against an adversary and inspectable by a stakeholder can be engineered. Software can't look out for both the person running it and the person selling it simultaneously when their needs are mutually exclusive. Cory Doctorow has some eloquent content on the topic, ie at [0]. In this particular case, the use of TLS (good!) makes it relatively challenging to inspect. Assuming the author isn't shipping a cert in his binary (doesn't look like it) - I'd have to spinup a new VM, load a custom root cert, and mess with a TLS terminating proxy / forwarding solution, and hope he's not using a secondary stream cipher on top of TLS. Maybe I get lucky and https://mitmproxy.org/ https://mitmproxy.org/ or something just works out of the box. In any case, lots of effort to know he's not siphoning up all the source code on the local machine and using it to train v2 of his project. And the more robust the DRM solution, the less feasible it is to inspect. [0] https://github.com/jwise/28c3-doctorow/blob/master/transcript.md https://github.com/jwise/28c3-doctorow/blob/master/transcrip...
- achamayou 8y ago
  If the amount of traffic is predictably small though, you can be confident that it’s not uploading the entirety of your source code, so perhaps some mechanism to estqblish that would help?