Hacker News Reader

Comment by bfirsh | Hacker News Reader

To those thinking of using this service, you might want to read this first: https://theoutline.com/post/1953/how-a-vc-funded-company-is-...

Discussion: https://news.ycombinator.com/item?id=14836653

View on HN

And that isn't even the full story. After Kite was forced to come clean about their Atom extension purchases, they were caught with yet another unrelated Sublime Text plugin that was phoning home to an IP address for an entire year. Their explanation? They forgot they were doing it!

https://news.ycombinator.com/item?id=14902630

Their only redeeming move could be to open source their project, and build a business model around that. Otherwise I don't see how will they ever gain back our trust, since they have repeatedly demonstrated a willingness to deceive users.

The original article contains this quote:

> I have to wonder if your goal was to upset enough people that you'd generate real attention on various news sites and get Kite a ton of free publicity before your next funding round,” @DevOpsJohn wrote

It seems to have worked out great.

From what I remember the biggest criticism was that they uploaded your code to the cloud, but if you read this, they say that it's now done entirely locally. So honest question, what would the risks be at this point?

What should compel anyone to trust them in the first place? Seems like the balls in their court to figure out how to regain trust.

edit:

>When we started Kite, we were excited about the possible benefits of internet-connected programming. We were also well aware of the privacy and security concerns some people would have.

So their approach is going to continue being to ignore what they did and pretend they're cool now. Alright, well you can download the maybe-malware if you want, I'll stay as far away as I can from this company myself.

I feel like the answer to your question is implicitly that there is nothing they can do. they're "cancelled". Even a personal apology (with supporting documentation) would be ignored, since you don't care about the product anyway. Is this true?

I mean, I don't necessarily disagree with you, they have to regain trust, but at some point you have to be open to it.

Trust but verify.

>...but at some point you have to be open to it.

Well no, we don't. Trust is difficult to gain and easy to lose, and almost impossible to regain. If the concept is sound then there will be others.

No, but they need to explain what went wrong to cause them to think what they did was okay, and why we should believe it won't happen again, at a minimum. If they have no integrity, and hijacking an open source project certainly is sending that message, then I can't imagine what other incentives would stop them from abusing my trust in them for their gain.

I would like something like this, but they need to address this more thoroughly. It's not just a footnote.

>Trust but verify.

What does that actually mean? If I verify, then did I trust?

I don't want to verify, but if they expect us to be doing that work for them they sure as hell need to open source it.

tl;dr Kite hired a developer for an Atom plugin and promoted themselves in this plugin. Kite acquired an autocomplete plugin and switched the engine to use their own.

IMO, the devs have the freedom to do whatever they want with the code they maintain. If the users don't like it someone can fork and maintain their own version.

>Is a $4 million venture capital-funded startup stealthily taking over popular coding tools and injecting ads and spyware into them?

Ads? Yea, I guess you can call cross product promotion an ad, but it's far from flashing banners up for sale on ad exchanges. Spyware? Hardly. A service uploading data and responding with results is a perfectly legitimate interaction.

In a corporate environment this may lead to accidential violations of Contracts. Usually code isnt allowed to leave the corporate network. So one day poor joe updates his favourite autocomplete plugin, the next day he violated a contract

An organization with those requirements should be careful which tools they use.

> A service uploading data and responding with results is a perfectly legitimate interaction.

this reductive description is too vague to bear the label "legitimate interaction". context matters, no?

I see it as the difference between a transactional email and an unsolicited one. This service seems to fall under what I would call transactional.

Reply on news.ycombinator.com