Kite telemetry code in Sublime package SideBarEnhancements(forum.sublimetext.com) |
Kite telemetry code in Sublime package SideBarEnhancements(forum.sublimetext.com) |
Like, I get working for even exploitative companies (though I won't)--economic insecurity is definitely a thing and we all gotta eat. But you can find a job that doesn't involve literally spying on the down-low. I promise you, you can.
Abandon these jerks before they bring you down with them. They've demonstrated a willingness to screw people and even if you don't really care about them screwing other people, they'll screw you too.
EDIT: Also, because it's on-topic and the post on HN seems to have gone ignored, somebody is typo-squatting `cross-env` on NPM and dumping environment variables to a Chinese server run by "HackTask", it probably deserves a signal boost: https://twitter.com/o_cee/status/892306836199800836 https://news.ycombinator.com/item?id=14901566
If you work for these companies in any capacity you're being highly unethical. End of discussion.
If a couple of employees leave, they'll be limping.
That's also why I didn't try to say that the founders or the executive team should be better. I'm talking about the people who those founders and executives use to do bad shit and who they will screw whenever it makes a tiny bit of business sense to do so.
Plenty of people work for literal sociopaths. It's rare that you can just point and go "...duh?" about it, though.
https://github.com/SideBarEnhancements-org/SideBarEnhancemen...
They're trying to figure out what languages people are actually editing on a day-to-day basis, and people here are calling for them to leave the company? Like, really?
People have been whipped up into a frenzy for data that a webapp wouldn't blink twice at collecting. But when it's installed locally it's somehow different than if we load a webapp in a browser?
I agree with you in principle, but it seems like people here didn't actually look at what was being collected. They just saw "data collection" and went absolutely nuts.
Yeah, collecting installed package names isn't really great, but it's pretty harmless, right? It's a stupid decision, but people seem to be looking for reasons to get upset.
They're not collecting filenames, and they take the sha1 hash of whatever could be personally identifiable. Why is any of this bad, or a violation of trust? They even say right in the readme that they're doing it and how to opt out: https://github.com/SideBarEnhancements-org/SideBarEnhancemen...
If they made it opt-in, no one would opt-in. I understand it's a slippery slope, but is this reaction appropriate?
2) Collecting non-bundled package names is another way to phrase "exfiltrating competitors' upcoming products." That by itself is sufficient evidence for me to want some heads.
"Yeah, we broke into your house and rummaged through your stuff, but it's okay, we were only there to count how many spoons you had.
Yes, I know, we could've asked you before we broke into your house, but we tried that before, and for some reasons we had no takers. And it was really important to our researchers that we get a good idea about the number of spoons!"
This kind of behavior needs to be stomped on hard and fast.
In fact, it might violate more than a dozen of laws in the EU.
This is a general matter of principle. You do not get to access anything that is mine without approval.
If no one opts in, that's your problem, and you need to rethink your business model - and not break into users systems and steal their data. This is malware.
I think developers are (rightly) afraid this trend now hits their editors.
> People have been whipped up into a frenzy for data that a webapp wouldn't blink twice at collecting. But when it's installed locally it's somehow different than if we load a webapp in a browser?
Well, yes. But it's even worse than that. This code was submarined into an unrelated open source tool and sent the data to a company with which the user had no relationship whatsoever. That's a little different from Google keeping track of how often I log into GMail, isn't it?
Even the README you linked to (probably not seen by many users) seems intentionally misleading, as it is careful not to state to whom the metrics are sent, leaving the reader with the impression that they are being sent to the project maintainer and not to Kite, Inc.
tl;dr for that is basically:
Kite has been collecting "anonymous" data from sublime users with the SideBarEnhancements plugin installed. This has been happening for atleast a year and the data collected included activeNonBundledPackageNames which is basically a list of packages installed via Package Control.
It seems they were intentionally unclear about who the data was sent to and did not think to remove it from the plugin after the Atom Minimap incedent because:
> the truth is we didn't remember [2]
[1] https://www.reddit.com/r/programming/comments/6qwtfz/kite_in...
[2] https://forum.sublimetext.com/t/rfc-default-package-control-...
You cannot fight this kind of malevolence with a finger-wag and a proposed solution that you simply inform the user next time before doing it. It will become buried inside the ToS and become ignored and commonplace. Stop it now and forever, while the spotlight is on it.
If we can't trust that an addon we installed yesterday is safe today, their platforms just turned into gigantic malware vectors that are totally wide open.
This kind of exploitation needs to be stopped immediately.
All of these package ecosystems are similar to NPM in that they are built on trust and community policing. This is not enough. One possible way forward is to move towards an security model more like iOS's or Androids where apps need to explicitly get the user's permission before performing potentially dangerous operations like making network requests.
I'd be interested to hear how other platforms have tried tracking these sort of concerns
So far we've operated under a model of requiring the end user trust the package developer, which isn't going to be the case 100% of the time. We are set up in such a way that the connection is required to be secure to prevent hijacking the connection and replacing packages with hacked versions. But if the package developer is choosing to add code, that is more of a policy issue than technology issue.
Sorry Kite - fool us once, shame on you. Fool us twice, shame on us. There's now a 0% chance of my ever using your products or services.
We now know of 3 different popular addons they've hijacked in various ways to snoop on code and to build up their business.
If one company is doing this, it makes me very concerned what else is going on, and what else is coming.
But you can see kite's own installer uses the same ip address for its telemetry: https://github.com/kiteco/kite-installer/blob/master/ext/tel...
https://github.com/wbond/package_control_channel/tree/master...
This is a complete destruction of their narrative from last week. They'll be sorry for being caught - again - and we'll have to be on continual lookout for this kind of thing in the future. I can't wait for the floodgates to open, once major tech companies figure out that there's not enough oversight to prevent this 100% of the time: I expect more than a few projects to be bought out similarly.
I discovered tracking codes inside a browser extension back in 2013, and I doubt that it would be the last one:
https://paradite.com/2013/12/07/solved-issue-with-vglnk-all-...
(Ironically by visiting my blog post you are contributing to tracking by Google Analytics)
That's interesting, where's the opt-in for that on your blog? I don't see a modal that asks me before transmitting any of my data, or even giving my IP to a third party, or doing any tracking, as is required by EU law.
You just kill all credibility on the way and you will be outlawed by maintainers etc.
We may be many but at certain bottlenecks ethics is still high and with OSS we are able to just fork packages.
As companies start to exploit developers trust we have to rethink the security model inside our IDE`s and probably move to a smartphone like sandbox model.
Sadly, I think it's what you might call "evil genius".
They seem to be very keen on paying addon developers to distribute their crapware.
Is there a single IDE with plugins that has a security model in place that would prevent plugins from being taken over by nefarious asshats?
I love vim and emacs... but what's to keep them from being affected by the same thing? Who has time to read all the source code of every plugin/dependency that they use?
It's all about trust and what Kite is doing is completely destroying the network of trust in each of the communities they choose to infect.
Like, did they not think that we wouldn't catch them in the act?
Don't try to steal from thieves.
If you have the .sublime-package file still, you can unzip it to that directory and modify the extension
I've been reading for about 10 minutes and can't find any references. The closest I found was https://twitter.com/gerardroche/status/891802572373319680 which links to https://github.com/kiteco/kite-installer/blob/master/ext/tel... but that doesn't actually say what they're collecting.
That class seems to be collecting time spent, identified by the variable `name`. But it's not immediately obvious what `name` is being set to. If it's set to a full file system path, then I agree it's a breach of trust. But if it's something generic like 'options screen' then clearly they're just trying to improve their product.
People here seem to be losing their minds over this, so I'm trying to figure out whether it's justified or if it's another game of telephone.
EDIT: Found the code: https://github.com/SideBarEnhancements-org/SideBarEnhancemen...
Am I misreading this, or is everyone losing their minds over collecting how much time was spent editing certain file extensions? The only thing that seems to be remotely dubious is "activeNonBundledPackageNames", and that doesn't seem sensitive.
> Post #27 (wbond):
> > adam314: Hi everyone, member of Kite here. The SideBarEnhancements telemetry was
> > originally added to gather data around what programming languages we should support next.
>
> [wbond:] The question is, why did you try to hide who the data was being sent to? And why did you ask
> to capture activeNonBundledPackageNames? That bit of data seems like a very non-anonymous
> collection of information. You could be capturing internal package names and consequently
> exfiltrating the existence of development of competitors products.
I hate that we're even talking about your company and that we have to because it's a bad actor that's hurting people. Talking about what you're doing, even condemning this ratshit behavior most strongly, kind of empowers your company, and your company doesn't deserve press--even bad press. Kite deserves the equivalent of an unmarked grave.
https://github.com/looterz/grimd/blob/fc327b2f2993f762c8557c...
If this it becomes commonplace for text editors to spy on some types of (meta)data, a warrant may not be required for the police to gather the same type of data without a warrant even if you do not use a "common" editor.
Without an easy way to know who the package is connecting to, it only instills a false sense of security.
Shown when you hover over the question mark.
I doubt they even thought of the competitor angle. I wouldn't have. Startups don't win by worrying what every new company is doing.
It wasn't a smart decision, but you're acting like they are uploading your entire source code tree. (I think someone even claimed that they were doing this at one point but was later shown to be mistaken.)
I'm willing to be strident because heads on pikes are how you ensure this is not repeated in an amplified way. Kite might be dopey, stupid, careless, and mean instead of actively malicious. Doesn't matter. The next one will be if clear lines are not drawn.
The thing is, market forces are pretty good at settling these issues. It's an open-source plugin, so everyone can see what they're doing. If they start being naughty, people can uninstall and switch to something else. But why are we punishing them before they did anything serious, along with locking down the ability of anyone else to ever collect any kind of usage data about their plugins? Even something harmless like "time spent trying to figure out the options screen"?
I hope it doesn't seem like I'm trying to defend spyware here. Collecting metrics about your product is the first step toward improving it. The motive seems like a positive one, not a negative greedy one.
Moreover, a valid solution doesn't have to solve every problem. Abandoning Kite is already a good start.
Kite is the primary corrupting force here, but the people who keep taking money to screw over their userbase need to be punished as well.
Sublime, Atom, and VSCode all need to step up right now and make it clear that this kind of behavior is 100% unacceptable
Edit:
Allowing this addon straight back into the Sublime ecosystem reflects extremely poorly on them as well.
https://github.com/SideBarEnhancements-org/SideBarEnhancemen...
I'm not sure how Package Control handles removals of packages but if they are left installed in sublime then this was probably the best move.
If the package was left "orphaned" in the editor the telemetry would remain but I'm pretty sure PC updates packeges automatically by default so pushing an update without it makes sure the code is removed for most users.
This is an important point, and it's one I overlooked. I've never used SideBarEnhancement. I assumed users knew it was related to Kite. If `urlopen('http://52.52.168.91/status', json_body)` is the only indication where the data is sent, then that's unacceptably vague.
I suppose it's best for Sublime to force plugins to be opt-in for data collection, but as someone who wishes devtools were better, it's unfortunate a few groups with terrible PR skills are ruining it for everyone. It didn't need to turn out this way. They just needed to be open about what they were doing. They weren't even collecting anything to warrant being sneaky.
Considering how many posts you've made in this thread defending Kite, this seems like a major gap in your understanding. A simple ctrl-F of both the Github README and the PackageControl page show no mention of Kite.
I'm curious how Kite got the telemetry into that extension if it's unaffiliated. https://github.com/titoBouzout seems like a fairly standard github account, though it's strange he had no commits for six months until this incident.
There are probably browser extensions better suited to restricting browser connections. Maybe run LS on top of one of those so the browser can catch most of them witout making a ton of popups.
I don't endorse Kite's behavior, but our reaction here is so far over the top that it seems like normal onlookers will start to take us less seriously. We're talking about violations of law and data theft over answering the question "Which language are you editing today?"
Zero tolerance is a rejection of "Let the punishment fit the crime."
The European General Data Protection Regulation [1] is coming, and everyone that doesn't comply with it will have more than just a little problem.
No site or program is allowed to track or store anything about me, to transmit anything to a third party, or to even connect to a third party without my explicit authorization, and I have to be able to opt out of it all, and still be able to use it.
This is a simple moral principle of consent. You don't get to access anything that is mine without my explicit consent.
[1] https://en.wikipedia.org/wiki/General_Data_Protection_Regula...
There's to say though, as a counterpoint, that said principle always takes into account repeated offenses (recidivism), and they are at strike 3 or something.
How that pertains to a normal website on the internet, I am not sure.
*Edit: At least this is my understanding and my company is already making development plans on how to comply with the new law.
So, if you're outside the EU, and you violate it, you might suddenly experience that your bank accounts get frozen.
[1] Just look at the recent case where US citizen sued Saudi Arabia in a US court, and the US senate overrode a veto of President Obama to allow this to happen supraterritorially.
This plugin is not their product, they are merely taking advantage of it's popularity for their own purposes.
> The thing is, market forces are pretty good at settling these issues
True, and the market seems to be unhappy with this approach and publicly taking a stance against it, right here. I believe this is as serious as any other case of hijacking a popular extension for collecting data, the specifics of what is being collected don't matter the littlest bit (and could change at their will).
On "positive intent": they did all of this with a commit message that doesn't mention 'Kite' at all, even uses a hardcoded IP address to avoid a domain name. It was clearly shady and meant to go unnoticed.
"Telemetry" and "personally identifiable and sensitive data" are very different things both morally and legally and boy howdy do I have a different reaction to one or the other.
Market forces are only good at settling issues when the market participants have perfect information. Nine months of spying that somebody just happened to notice to reveal it? (Ditto the Atom thing?) The damage has already been done. "With many eyes, bugs are shallow" has a certain truth to it (although I have Heartbleed calling on line two), but nobody's auditing everything, nobody can audit everything, and the damage that can be done because nobody has that information has the potential to be both personal and very high.
They did do something serious, is what I'm saying. Consider people who use a text editor--the same text editor they write code with!--for, say, a list of notes. I have a list of meeting notes in Markdown, for example, in a git repo. Sure, I doubt Kite is paying attention to that I met with X on Y. But I really, really don't care that they're not paying attention (because I don't know who's gonna get ahold of it next--are they keeping it, are they packaging it for resale, is their server pwned, how do I know and how do they verify). Fundamentally, I care that they stole it. The act demonstrates either ill will or negligence so grave as to substitute for ill will.
"Telemetry" and "personally identifiable and sensitive data" are very different things both morally and legally and boy howdy do I have a different reaction to one or the other.
If I'm reading this correctly, you're saying Kite has access to your meeting notes? How? According to the diff, they were only uploading the file extension.
If they're uploading PII (let alone the contents of code files), that's completely different, and I'd turn on them in a heartbeat. Did they do that?
(This is the same reason, scaled down, that people are angry and concerned about stuff like phone metadata collection.)
OK, so you acknowledge that this was an unacceptable privacy breach, you're just a little less upset about it than some other people here. Damning with faint praise, I guess.
> I'm curious how Kite got the telemetry into that extension if it's unaffiliated.
They probably paid him.
I'd rather look like a fool and get to the truth than stay silent and let a story go half told. At least people are clear about what precisely was being collected.
That's why I was so confused why people are upset.
I guess it's best to enforce a blanket ban on this behavior. I still can't get over how dumb it was for Kite to do this. All they had to do was be open and honest about it and nobody would've cared too much. Crossing over into the realm of paid spyware is way too far.