If you're reading this Kite. I now have a negative view of your product. We cannot allow corporations to take over open source tools. Donating is perfectly fine and encouraged, but the above example is a downright take over. If you want another tool then create one, don't take over an existing one and use the communities trust of that tool to promote your product.
I fell for this. I enabled it because I was curious about trying new development tools, only to find out later it uploaded all of the source code on my computer to their service. What the hell.
It took me months to get through to a human to get them to delete my code, including two emails to the CEO.
I like the idea, but there is no way I would use it after this experience.
WTF, this could get people fired. Many companies do not descriminate whether an employee has uploaded code to a third party server intentionally or not. If corprate software monitors catch this happening, its pink slip in many places. I just can't believe anyone would play with developers this way. What a cruel company.
> WTF, this could get people fired. Many companies do not descriminate whether an employee has uploaded code to a third party server intentionally or not.
That is why developers should be very careful what applications they install on the corporate computer and what cloud services they use.
> it uploaded all of the source code on my computer to their service.
That sounds crazy, so I reviewed their privacy policy[0]. It looks like Kite now requires users to whitelist the directories it indexes and automatically purges files you remove from the local index.
The Privacy Policy says that:
> When you use our services, we may collect [...] Any source code files on your computer's hard drive that you have explicitly allowed our services to access. To learn how to control access to your source code files, please visit our FAQ.
The FAQ[1] says
> Kite only uploads files that:
>
> 1. Have a .py file extension,
> 2. Are children of a whitelisted directory,
> 3. And are not ignored by a .kiteignore file.
That doesn't seem like "any source code file on your computer" to me - unless it whitelists root by default, which would be a hella dark pattern.
Also, removing a file from the local index should remove it from the server as well [2]
It sounds like they changed something after I signed up. I am not super paranoid, but I am pretty savvy about privacy and keeping my data safe. There is no way in hell I would have agreed to upload all of my data to their service.
I was actually questioning myself when I realised what had happened -- I thought, "perhaps I just messed up". But after I saw this story about their other dark patterns, I'm convinced they just deceived me.
Hard to read that wording and not infer it was specifically phrased like that to prevent saying "we upload literally every file, recursively, in the below directory".
Easy to see very intelligent and circumspect people interpreting "where enabled" to mean "when I ask for autocomplete" and "your code" to mean "that specific snippet" because who the hell would actually think it's cool to just carte blanche upload other people's workspaces?
> Also, removing a file from the local index should remove it from the server as well [2]
Maybe you are thinking only for your self. What about the majority of the users of minimap/(other hacked plugins) who doesnt know this is going on, and they are not aware that some files need to be deleted from someone elses server.
ps. i know "hacked" is not the proper term here ,but you get the idea.
I totally agree that putting proprietary integrations into open source packages is shady. However, I don't think that the Minimap "kite promotion" [0] went so far as too actually upload code to Kite's cloud platform. It looks like it just added tool tips that referenced Kite's documentation. That's distracting and unwanted, but not as egregious as uploading your code without permission.
Not sure when you're seeing the privacy policy change was made but as an early user of the Kite desktop tool, directory whitelisting has been in place for a year or more.
I have zero faith this page actually works though. A few months ago I deleted all of my data and I checked back today and it has reappeared. (I uninstalled the client and deleted my login token back then too, so as far as I can see it's their issue.)
I have sent them a stern email to delete my data. If you want your data deleted too, I would recommend doing the same rather than trusting their web interface. None of the emails on their website seem to work, though. Emailing the CEO does work eventually, but I don't want to start a witch hunt. My email is in my profile if you want his email.
Well technically you did consent by clicking "Enable Kite". I'm not familiar with Kite but the linked image has a line that says, "Click here to learn more.". I'd wager that it eventually links to a page that explains that all your source will be uploaded to their servers.
I don't really want to defend Kite, but when it says "Kite achieves this by analyzing your code in the cloud" I would assume that my code is uploaded to the cloud.
My assumption from that dialog box would be that at most, the code I currently have open in my editor would be uploaded. Not all the source code on my computer.
How can autocomplete work without looking at all the other code too?
Edit to add: oh, wait, I misunderstood. It grabs all the code on your computer? That's crazy. I just meant it's not totally unreasonable to grab the whole git repo you're working in, say.
If you're going to upload potentially private code from your user's computer to your servers, you better warn him with big fat red letters before you upload a single byte.
I'm not defending their actions. I'm just saying that I don't think they're as surprising as people make them out to be given the messaging in the product.
This is why some data protection and privacy laws are starting to require active, informed consent before taking some actions, instead of merely specifying "consent".
Even without that, basic contract law in many places requires a degree of mutual understanding for the contract to be valid in the first place. You can't just bury a surprising term with a huge effect deep inside a long legalese document and expect it to actually stand up in court, and if you're doing something dubious and relying on that as your defence then you might be in for some disappointment.
What they did is figuratively a felony (literally a "indictable offense") here in Canada. These guys are going to go to prison. Courts have ruled time and time again that hiding unreasonable or otherwise illegal actions in ToS does not absolve liability or criminality.
Just out of curiosity, what part of this is considered illegal? Not defending Kite here, but it seems that even though they are using some shady tactics to gain users, none of their product/ToS seems illegal.
Copyright infringement is not theft. These are two completely different issues. When data is copied it is not taken away from the owner like when physical goods are stolen. Secondary damages may or may not occur, but they are not the same as depriving someone of a good. As an analogy, I wouldn't steal a car, but I surely would copy a car if I could do so by simply pressing a button...
This isn't necessarily only about copyright infringement (though it's definitely that too). If some of the source code on your machine contain sensitive information, like API keys, database passwords, etc.
Legally, the word "theft" isn't only used when one party loses anything; a victim of identity theft doesn't lose their identity, yet we don't call it "identity infringement". I'm not familiar enough with US law to know for sure, but it wouldn't surprise me if the word "theft" is used somewhere for obtaining sensitive information without permission.
That still leaves corporate espionage, which (last I checked) is a very severe offense. If that "source code" contained significantly-sensitive data (like medical info or info about legal cases), then there's a giant can of worms right there (and each of those worms has a surname of "Felony").
Copyright Infringement is an act, and at least here in the US, an act which both criminal and civil laws provides specific penalties/remedies. On the criminal side, obviously, one of the penalties is imprisonment.
Ah, I was unfamiliar with criminal penalties for copyright infringement. Could you go ahead and link me to the relevant US Code text that provides for such penalties?
But that's about as unlikely as the code containing trade secrets.
Plus:
- For copyright infringement, they'd need to actually redistribute the code. Using it for machine learning and distributing short snippets wouldn't be copyright infringement.
- For that trade secret stuff you'd need to prove intent.
For copyright infringement, they'd need to actually redistribute the code.
IANAL, but I don't think so. In MAI v. Peak[1], the court determined that even loading a program from disk to RAM was a copy, and therefore infringing without a license. Congress has since then added a specific exception for "Machine maintenance and repair", but that's it. Copying from a remote machine and storing it in their disks should certainly qualify.
> But that's about as unlikely as the code containing trade secrets.
Unpublished code, is itself a trade secret. Even just the processes, procedures, organisation, tooling, library use, etc in the code provides a competitive advantage. i.e. The 'metadata' is also a trade secret.
The only intent you'd need to prove is that the accused is using the trade secret to the 'economic benefit of anyone other than the owner'.
It seems obvious that Kite is training a proprietary ML algorithm, with trade secrets, for their own economic benefit.
Makes me imagine some angry and equally shady person might contribute to some open source projects that Kite uses internally. With a ToS addition giving them access to all available data on the company network if you are Kite.
Obviously this would a be a terrible thing to do and no one should.
It does not just feel criminal, it probably is. On top of that it might make you liable for reproducing some company code without permission. Very very bad idea.
I've almost been bitten by them in the same way. I vaguely remember that it was through HN that I found out about Kite and installed their plugin(s). It definitely felt 'dirty'.
>only to find out later it uploaded all of the source code on my computer
It didn't ask? Sounds like malware, and meets the definition of theft. Inviting someone into your house does not give them permission to steal things in your home, and leave with them.
It clearly states in the diagram that the code you run Kite on will be analyzed in the cloud. If it truly uploaded "all of the source code on [your] computer" then obviously that is radically different but from my experience with the product, it did not upload my code besides what was directly related to what I was working on and understood would be analyzed in the cloud, just like Code Climate or any other code analysis service.
Iff they had foreknowledge that the changes were going to happen, which is unlikely. Id be surprised if Kite bought/acquihired/etc the product by disclosing a list of shady changes beforehand.
The question remains, would he have accepted the purchase/job if he had known that Kite intended to do this? My point is that he probably didn't know until instructed to do so my his new bosses.
This changes their power dynamic. One could argue they ought to find another job once the shady stuff started, but I still think you should focus on the actual instigators rather than the pawns.
In a security-sensitive corporate setting it is already harmful if anything gets uploaded to some cloud service - if this occurs, the damage already happens and anything that follows is "just" damage containment.
I believe about every company that develops software has some clauses about what software is allowed to be installed on the corporate computers and who has to initial any request to install a new program on the computer.
It's interesting watching HN get indignant when a company treats them the same way their idol companies treat everyone else. A lot of grab all data, track everything, and hide the creepiness in fine print type companies.
A system of permissions for plugins would be welcome in my mind for Atom, similar to browser plugins or mobile apps. Then a new "feature" would require the "transmit your code to a third party" permission.
> We cannot allow corporations to take over open source tools.
I don’t know how much I agree with that statement in general. There are several major open source projects with corporate “control” – Mozilla, Google and Apple control/heavily influence Firefox, Angular and Swift respectively and there are probably a dozen others. The idea that corporations are “bad” is a tired trope. Some corporations are bad, some are good, some are in the middle.
But I agree with your actual actual sentiment though – corporate involvement in open source should be as benevolent as possible.
"Corporations are organized around profit, open-source is not. With only that in mind you can predict what will happen in most of the cases.
"
All three of these statements seem like nonsense.
First, "Corporations are organized around profit".
No, they are legal entities, organized around articles of incorporation. These have a purpose statement. Often, those purpose statements are directed toward lawful business goals.
But you do not have to be.
Non-profit vs profit corporations can, quite literally, have the same set of purposes. The only difference between the two is what you can do with profits.
"open-source is not".
I'm not even sure what you are trying to say here.
Very large amounts of popular open source, is, in fact, produced by for-profit companies, and has been since the beginning of open-source.
The term was even created by a group of people at a for-profit company. So ....
"With only that in mind you can predict what will happen in most of the cases."
No, you can let whatever biases you seem to have stoke your imagination and prognosticate. You can't actually predict what will happen. There are plenty of happy, well functioning for-profit companies in open source that have been helping open source for many many many years. There are also plenty of non-profits that have harmed open source greatly.
It takes a lot of blindness to see this stuff as simply black and white.
I explicitly tried to put out "god" and "bad" from the discussion but OK, let's do that.
Red-Hat main worry is to be profitable. That's is above any other concern.
You can be sure that, if their bottom line was threatened, they will be pushed, in order to survive, to change their business model and they will not be beyond behaving in a "bad" (but legal) way if they don't see other way around the problem.
If fact, we can argue, that Red-Hat management, being it a public company, is forced by law to do that.
I'm sure you're aware of the Solaris exodus that happened when Oracle decided to make OpenSolaris proprietary after acquiring it from Sun. The entire OpenSolaris engineering division quit in the span of a month. Do you think the same wouldn't happen if RedHat decided to start doing horrible things to their customers or the community?
You're acting as though nobody who works at Red Hat cares about the community which they worked with before they had a job at Red Hat. I work at SUSE, and I work primarily as a member of a community. If SUSE started mistreating their customers or the wider community I would quit.
I hope that if you found that your company was mistreating the wider community you would also quit.
--
My point is not that "all companies are good". I'm saying that making a judgement that "all companies will harm free software at the end of the day" ignores the fact that companies still need humans to work for them that do said contributions. Personally I find that many people who work in free software have quite strong ethics when it comes to things like this, but that's just my anecdote.
My (somewhat strong, sorry about that) response was mainly a reaction to the larger trend I've seen in the free software community as of late -- that companies that work on free software are somehow a net negative.
I don't know where this view comes from, it was Stallman's goal from day one that it should be possible to have companies built around free software. The fact that my first job out of high school was working at a free software company should be celebrated as a huge accomplishment by the wider community. But it's not seen that way. I find it quite disheartening, because I've always been an advocate for free software and my job title doesn't suddenly change that.
I realise that you're not saying that (and so I'm sorry for the strong response), and of course we must question the motives of companies. But it's become a popular game these days to pretend as though everything that a free software developer does as part of a job must be part of a conspiracy to create a monopoly -- it's ludicrous and is quite grating.
History has proven time and over it's generally a very bad idea to be dependent on others' good will that is by nature self interested and ephemeral.
I think people are interested in their basics, income, job, family before any other priorities.
Some people infact become so paranoid about this they may overlook even support unethical action as long as they are safe.
Surveillance, profiling and dark patterns by leading SV companies including Google, Facebook, Palantir etc composed of tens of thousands of engineers who may at one time have loudly proclaimed contrary values is just one example of this.
But how, in the end, did that affect Oracle? Did their stock price drop? Were they unable to sell things? Or did business kinda go on as usual?
The comparison isn't as appropriate, as Oracle is a much bigger company, and is able to handle the loss of that many people in a better way. But the jist is similar.
Oracle Solaris is on life support because they don't have any of the old engineers. They have not worked on ZFS or DTrace since then (and the illumos community has massively improved those projects in the meantime). Recent news makes it look like Oracle Solaris may be killed quite soon.
That was the result, they tried to mistreat the OpenSolaris community and then Oracle no longer was competitive in the Solaris space.
If fact, we can argue, that Red-Hat management, being it a public company, is forced by law to do that.
You could argue that, but you would almost certainly be wrong. It is a myth that management at a company is always required to seek profit above everything else. Indeed, many companies explicitly do not do this, for example by having policies about operating in an environmentally friendly way for ethical reasons.
Companies have policies until they stop having them.
I'm not saying that companies have to search profit above everything, I am saying that it's its main concern, otherwise they will not survive.
Indeed, management will have space to be nice when things go well, but they, automatically, will receive pressures from investors to change their nice ways when things go bad.
This is the way that it's intended to work and there is, I think, nothing surprising there.
Even if it were as simple as that, it wouldn't be as simple as that!
There's a difference between short-term and long-term profitability. Being 'nice' might limit profits in the short term but might be crucial for long-term survival.
And, nobody knows for sure what the correct long-term strategy is. Not every step that yields an immediate profit is a step in the right direction.
For instance, you call Mozilla a non-profit. But it is a non-profit corporation, a legal entity that has organized itself in a certain way and applied for special tax treatment.
Isn't Mozilla organized as a for-profit that owns a non-profit? Actually, if you look at US tax law there are reasons that some non-profits have for-profit parts. I know Mayo was organized that way. I think it had to do with some salary requirements, but its been twenty years, so I'm a bit fuzzy.
There is a non-profit (The Mozilla Foundation, affectionately referred to as "mofo") which owns a for-profit (The Mozilla Corporation, known as "moco") as a wholly-owned subsidiary.
The Mozilla non profit is the owner of a for profit company that carries out much of their activity. Which you probably meant, but you've typed it the other way around.
Sure, as stated in the articles of incorporation. Many states offer an in-between type of corporation called a benefit corporation. It is for-profit, but the articles of incorporation require it behave, additionally, with social benefit in mind. And they are obligated by their charter, and can be dissolved by the state responsible for the entity's creation, if they don't follow it. The public would have some degree of standing that wouldn't necessarily apply to other corporations.
Technically, non-profit only means that the corporation is not allowed to directly redistribute profit to it's shareholders. This reduces the amount of pressure from shareholders to generate large profits, but still even non-profit corporation has to pay it's expeditures somehow and not lose money doing so.
> This reduces the amount of pressure from shareholders to generate large profits
Just to clarify, since this sentence was ambiguous: not-for-profit companies do not have shareholders or owners. So the fact that there is no "pressure from shareholders" is vacuously true, because there are no shareholders.
Not-for-profits typically have donors and boards of directors, who both apply pressure to see the corporation's funds used to realize its mission.
When I wrote that sentence I thought about changing "shareholders" to "members" or "stakeholders", but then I left it as it was because it seemed to more clearly represent the contrast or absence there of to for-profit corporation.
I'm board member of smallish Czech non-profit and one of the things I've found out is that the legal requirements on the corporate governance structure are mostly equivalent to what is required for publicly tradeable corporation that is actually not publicly traded, thus for me it makes some sense to equate voting members to shareholders.
> With only that in mind you can predict what will happen in most of the cases.
With just this information and no other, I think I'd predict corporations to make better software than open source. I take it that's not what you had in mind.
(This is for similar reasons that I expect for-profit companies to provide better service than government-run ones. I don't particularly want to get into a debate right now about whether that actually happens, just trying to explain my intuitions.)
For a non-technical user Windows is the infinitely better product than typical Linux desktops, you should see the pain that people go through that use commercial software nominally supported on Linux such as Cadence tools compared to the same experience on Windows, not to mention the lack of any serious well made office suite.
Heck in direct comparison Ubuntu 16.04 looks like a joke system compared to Windows 10, for example Ubuntu doesn't let me use my on board sound and only displays the dedicated sound card, but only half of the time. It has a horrible toy like ripped off user interface with ugly buttons, I can't think of a single application that is actually better than an equivalent application that is also available on Windows.The only reason I'm using Linux is because in a lot of areas including the field I work in it has achieved the same lock in that windows has for the general desktop market.
It is kind of sad that the only two alternatives are a clone of 70s technology or a clone of 80s technology. I feel like there should be a way to get things unstuck, but research into operating system design has all but ceased, with very few exceptions, many of them ironically coming from Microsoft.
Ubuntu is backed by Canonical Ltd. so it's corp vs. a much bigger corp. Linux as server vs Windows Server might be a more appropriate comparison for this.
It's so frustrating that the data derived from this reality never agrees with these simple economic theories I derived from first principles and my econ 101 class that are so obviously correct.
I blame the so-called "experts" and their propaganda about "complexity" and "human behaviour" for distorting the efficient market. In the cases of historical data it seems they have even retroactively distorted the markets.
I didn't say corporations make better software than open source. I said that if I had only a single piece of information that's the prediction I'd make.
I have opinions about to what extent my counterfactual prediction is correct; and to what extent it's not; and why it fails, in the cases that it fails. I left them out because they weren't relevant. If you wanted to talk about them, that's a thing I might be willing to do. But I'm not interested in being snarkily accused of mistakes I didn't make.
What I mean is this: If you mix open-source with a for-profit entity, don't be surprise when that entity try to extract profits even in orthogonal ways to the original intention of the project.
Of course, in practice, and by the nature of open-source, this is a very difficult to do and, normally, can be prevented, but the trend is there and should be take into account.
Mozilla made firefox. Google made angular. Apple made Swift. That's not "taking over". While I am not a fan of this phenomenon either, that has nothing to do with the current situation. They simply built something and open sourced it, nothing was "taken over".
I'm going to take a contrarian stance on this one: I believe there is no story here — adding an ad for an opt-in cloud-based tool to dev tools is not spyware. It's opt-in! It's clearly stated. Would people raise a fuss to find out their CI service like CircleCI or linter service like Code Climate had access to their code (it's sufficiently obvious)? I don't really see why this tool is any different other than they are one of the first to make a code analysis service that runs in realtime.
I beta tested the Kite product when it first launched maybe two years ago. I don't use it today but I would try it again. Since then they've only tightened down on permissions and made things clearer.
Kite was also not the first to run ads in an IDE plugin (Wes Bos has sponsored several), at least not in Sublime. Personally it's not my preference to have ads either but ultimately this is up to the maintainer of each repo. The tool is still free to use. It clearly states that using the cloud engine will upload your code to do analysis in the cloud. It's 2-3 sentences, not like it's buried in some long EULA.
Shame on the article for labeling inserting an ad as "taking over" and labeling an ad as "spyware"… pure clickbait targeting non-devs.
The new Kite engine also clearly states it is a cloud-based service and they build integrations for their service. The whole industy works the same way. You don't have to use their engine to use autocomplete-python and its opt-in too.
It appears you have misunderstood my argument. The atom-minimap extension you linked is not the autocomplete-python extension discussed in the parent thread. I have not used the atom-minimap extension and didn't make any comments on it — I use Sublime. My comments are about the autocomplete-python extension.
I think you're overlooking the diagram linked above which shows enabling the Kite engine is an opt-in button click.
The CEO also states that it is opt-in in the article: "Most users who install autocomplete-python close the engine selection prompt, which results in not getting Kite or its benefits," [the CEO] said in an email.
As I stated above, I beta tested the Kite product early on and have used it in Sublime through a similar add-on. I am not a current customer / user, but I do make my own dev tools. It was always completely transparent to me that they are sending code to their server to run a cloud analysis platform. Based on that, I still maintain that the community is massively overreacting to something that was made explicit upfront.
Well, who benefits from having the ads there? Wouldn't it be better for most users without the ads? What value is Kite adding?
It's a slippery slope, similar to the controversies over using BitKeeper for the Linux kernel or adding DRM to HTML5 (both justified, I think). The openness in open source needs to be defended.
While I would not argue anything about ads directly, I think that all users benefit from having additional options in the plugin, and if the ad is relevant to a portion of users and leads to some users discovering an additional dev tool for their workflow than it was worthwhile. That is the perspective I have in mind for the hypothesis that Kite was testing.
I genuinely don't understand why this service is getting a disproportionate amount of backlash relative to the plethora of cloud based services out there that analyze one's entire codebase. Maybe it's because they're interacting with the code from the dev machine directly vs integrating with repos on the git server? Would that make it different to you?
The massive difference is that Kite is using manipulative, dishonest tactics.
When I sign up for a service like Code Climate it's very clear that I am giving them access to some of my code. I also have easy control over what code they can see. They are honest and upfront about what they are doing and why.
Kite has been trying to hide what they are doing, with the goal of tricking developers into doing things they otherwise wouldn't. They're taking advantage of the huge amount of trust in the open source community. Kite must know that abusing this trust has a high chance of hurting the community, but they don't seem to care, as long as they can make a quick buck or two for themselves.
A lot of people here really cherish that trust and goodwill among strangers in the open source world, and are understandably pretty pissed when someone comes along and messes with it.
The bottom line though is being honest and upfront with developers. I suspect Kite could have been a bit more forward about what they were doing and the developer community would have reacted with much less outrage.
Where I work, the VPE signed up for Code Climate. Code Climate also gets our code by asking for git creds, making it very clear what they're doing.
Installing Kite and accidentally allowing them to sucker me into uploading the entire corporate source tree -- quite possibly with creds -- is literally a walk you out fuckup. At bare minimum I would have to page ops and roll creds on every bit of prod. Want to know why there's both a gitignore and a git commit hook making sure 'config/creds.py' is not uploaded anywhere?
There's virtually no ethical way to build that dialog unless you put 40 point red font saying "We upload your entire source tree" and make you wait 10 minutes before continuing. This is not a decision line level devs are allowed to make on their own, and Kite tricks them into doing exactly that.
Hi Ruben, founder of Kite here. I think this issue deserves a more thorough response because there are a lot of misrepresentations in the article.
One misrepresentation that I wanted to quickly highlight is that the autocomplete-python install flow has three steps, not just the one linked in to in the screenshot above. The other two are:
Small technicality: these screenshots say that Kite is installing but it's actually only downloading the installer binary to memory; the actual install doesn't happen unless the user goes through all three steps.
It's also worth noting that if the user clicks "Add Later" no code is sent to the Kite servers for analysis until they whitelist a directory.
You are trying to blame the user, but the design of this flow is to blame. It does not explain clearly what is going on.
It's funny seeing this now to see where I tripped up. When you say "enable access in /Users/ben", I guess 6-months-ago-me assumed it meant "enable access to code in /Users/ben when I am working on it". It felt a bit like an iOS permissions dialog, where I was giving you access to my filesystem. Parsing it now, I realise that the text above the button says "where enabled, your code is sent to our cloud".
You could argue I should have read that more carefully, but that copy doesn't scream to me "I'm about to upload all of the source code on your computer including proprietary stuff and secrets". Because that button was the default highlighted button, I assumed it wasn't going to do anything drastic like that. (It's like Ryanair having a big red "YES I WOULD LIKE INSURANCE" button, hiding the "no I don't want to spend $100" button somewhere in the small print.)
Above all, you certainly shouldn't have included that as a shady update to some Atom extension I was using.
> I think this issue deserves a more thorough response because there are a lot of misrepresentations in the article.
From the article:
> Smith also said that most of the negative reaction was due to confusion around what the tools actually do. (Connor pointed out that it’s not possible to review what Kite does, since it itself is not open source.) Then he blew this reporter off. “I apologize in advance that I can't answer any further questions,” he wrote. “I need to focus on other parts of the business, including continuing to improve the product for our users, and conflict like this is always doubly distracting.”
The above sounds like you were given the opportunity to explain things but shrugged it off as a distraction.
If it deserves a more thorough response, why hasn't that been given? Even in this reply you only "quickly highlight" one point.
Even with the additional steps and even with explicit whitelisting of directories (from screenshots it looks like it defaults to the user directory, which is just bad) before code's uploaded, the point is that Kite took over a useful, popular open source package, clearly hitching on to the popularity of the package to promote Kite, which is distasteful when it comes to OSS.
Why not fork the original autocomplete-python with one that has Kite enabled instead? Then users who want Kite or use Kite are able to do so, without screwing over everyone else who have no idea what Kite is and dont want anything to do with it.
Reminds me of software downloaded in the past that comes with some random search toolbar that gets installed in browsers. Annoying. Shady. Not cool.
This. That would have been the correct solution. Fork the code and offer their "Kite enabled" version separately. If Kite has to resort to these type of tactics to push their product it seriously makes me doubt it's efficacy. If they can't market their product based on it's merits, why would I want to use it?
If you're reading this Kite. I now have a negative view of your product. We cannot allow corporations to take over open source tools. Donating is perfectly fine and encouraged, but the above example is a downright take over. If you want another tool then create one, don't take over an existing one and use the communities trust of that tool to promote your product.