Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Since this program uploads code to the cloud, it would be worthy to clarify if it cleans out strings before upload or not. Because if it does not, it is a serious concern as it puts secret keys in code in awful risk.

They also run a background process that needs to be manually killed to be able to uninstall. It feels like a quarantine. This is an editor plugin, is there really no simpler way to provide uninstall capability?



To clarify, on Windows the uninstaller is just one step: double click Kite from the Programs & Features section of Control panel.

Unfortunately on Mac you have to quit Kite before it can be dragged to the trash. You can do that from the menubar icon or by killing "Kite Engine". (You don't need to quit Kite Helper to drag to the Trash.) See instructions here http://help.kite.com/article/6-how-do-i-uninstall-kite. We'll be improving this on Mac shortly.


Welp - after reading through these comments, seems like privacy and code upload are huge concerns.

Might be worth it for you guys to get ahead of this, and address these issues explicitly on the home page and during installation. It will lower short-term usage & install numbers, but probably won't hurt long-term retention and word of mouth sharing.


Thanks, we appreciate the constructive feedback!

We've worked really hard to make sure we're clearly communicating what's happening (transparency), and adding fine grained controls. We have a very clear step during the install flow that talks about how Kite works, and we will prompt for whitelisting within each of the editor plugins that can work without the sidebar (Atom, ST3, PyCharm).

We also have a security page (https://kite.com/security) that points to our various resources related to this, including more details about our control mechanisms—including .kiteignore—and how we think about security (our four principles).

We also know that some companies need on-premise Kite to make this work. We're exploring that now with customers, and would love to chat with you if it's something you need. (https://kite.com/enterprise)

I know none of these are silver bullets. Thanks for your comment as we work with users to figure out how to make this work.

We hope you'll give Kite a spin when you can—we think it's pretty transformative—and we hope to be able to address all of your concerns soon! : )


I could not find a privacy policy anywhere on your site after a few minutes of looking. This could be my own ineptitude, but it'd be good if it were easier to find. Where is it?


Instead of on-prem to start, you could probably get away with VM appliances people could spin up in their own cloud provider or VPC.

I don't mind code being sent to a server, but it needs to be a server I control.


Yes, absolutely. We plan to start with deploying to an AWS account the customer owns. We're pretty excited about it as the first step!


Everytime I killed Kite Engine a new zombie would just spawn up.


Is uploading code really that much worse than having closed source in a private cloud GitHub repository or pushing your closed source Python code to a PaaS platform like pivotal or bluemix?


It's not so much the upload, but the fact that it will always be unclear (and dynamic) what this service will do with a particular LOC. You might store sensitive documents in Google Drive, but it is unlikely you will type something sensitive into Google Search. Because it is a smart autocomplete feature, there will always be lack of clarity of when they delete your files, if at all.

Github and PaaS do not have any direct benefit of storing my lines of code forever. There is no logical comprehension of doing so. If they are caught, they will lose customers forever. In a service like this, however, it can always be claimed that the storage was done in order to make the service smarter. Which would be true. But it would be dangerous.

It is also worthy to note that this is a live tool. With other services, one has a chance to clean their code before upload. With this, even playing around with an API with embedded keys in your code has already put you at risk.


> It is also worthy to note that this is a live tool. With other services, one has a chance to clean their code before upload. With this, even playing around with an API with embedded keys in your code has already put you at risk.

Wow that is a really good point.


Kite address this below, they said they're working on adding:

"Fine-grained privacy controls modeled after the .gitignore file format means that you can selectively and precisely decide which files and folders Kite indexes"


1. On MacOS X it's quite impossible to kill the helper and engine processes, so you can remove Kite.app. Something is restarting them automatically, which is really frustrating.

2. It's completely unacceptable to upload code to the cloud.


As far as an uninstall procedure is concerned, the expectations of a MacOS X user do not involve looking up instructions on a web site. The user should be able to quite the app, drag it to the Trash and clean it.

In addition the instructions you posted on the web site do not work. There are two running processes shown in Activity Monitor: a KiteHelper and a KiteEngine. Killing them both does not work, they are resurrected by some process.

I had to manually rm -rf Kite.app, and reboot the machine to get rid of the pesky KiteHelper and KiteEngine processes. Totally unacceptable "uninstall" procedure.


Yea was annoying. To prevent them from resurrecting, remove kite processes managed by launchd before killing the current processes

* launchctl list | egrep kite

* launchctl remove :KITE_LABELS


Thanks. I was losing my mind over this.


So you don't use GitHub.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: