Comment by alexflint | Hacker News Reader

Comment by alexflint | Hacker News Reader

Parent Full thread

(Copied from above.) Totally legit concern. when we started working on this we realized if we wanted to index tens of thousands of libraries, we wouldn't be able to ship the entire index along with the client. Hence the cloud-based architecture. We've thought a lot about privacy and written up our thoughts here: kite.com/security. The short answer is: we don't index anything on your computer that you don't explicitly ask us to, and our plan is to earn trust the hard (i.e. only) way: transparency, published policies, and a track record of good decision making.

One of the big things we've worked on over the past few months is giving users fine grained control of which files are indexed by kite:

- Kite only indexes directories that you have explicitly enabled

- You can create a .kiteignore file (same semantics as .gitignore) to exclude specific files / patterns.

Would it be possible to allow a # nokite at the end of lines; these would then have any strings scrambled. This allows me to know immediately that things aren't being sent to Kite rather than have to do a few checks before I write something secret.

Actually, it should just remove strings if it does not already.

Good idea - will look into it.

Oh no, not tens of thousands of indexes! My 5 Mb hard-drive just couldn't handle it.

> when we started working on this we realized if we wanted to index tens of thousands of libraries, we wouldn't be able to ship the entire index along with the client.

Why not? that's a _tiny_ amount of data for a modern computer.

How many GBs would the database take on a local machine? Wouldn't it be possible to pick and choose what libraries to include in it?

I'd rather have a few gigabytes on my machine than have all the code I write automatically in the cloud.

I think this answer (which you used in few places here) does not address concerns people raised all over:

1) kite is useless (or at least substantially less useful) if you explicitly disable files/directories.

Example: Customer says: This fridge I bought, poisons my good. Company: If you don't put your food into fridge its not poisoned. Yeah, but it also not frozen afterwards, which was the reason for the fridge! And no files/directories/lines/whatever policy does solve that problem. Partially because of 2)

2) Human errors will kill this. Just google for number of problems around security tokens, sshkeys and other thing commited to github by mistake.

The only solution is LOCAL index only.

Why not just use .gitignore as a default (if local indexing is enabled)?

Reply on news.ycombinator.com