News for hackers. Stuff that matters.
Re:Kite: Thoughts on Security by adamsmith on Thursday April 21, 2016 @04:07PM (#11544990)
This is great feedback, and definitely something we need to address.

Initially we've been focused on giving users control and transparency. We need to extend this to employers.

One quick idea that we'd love your feedback on: a .kiteignore file that can exclude Kite from responding to files that match a certain pattern (e.g. "secrets.py"). Presumably an employer could put a "[^.]*" in a repo-level .kiteignore file, and anyone working with that repo would have to explicitly delete that file to use Kite with it.

We'd love to hear any other ideas folks might have as well!

Re:Kite: Thoughts on Security by fweespee_ch on Thursday April 21, 2016 @04:17PM (#11545040)
The only way to truly solve this problem is on-premise devices that do not push data to Kite, honestly.

I'd need to ignore every file I have.

Re:Kite: Thoughts on Security by LeifCarrotson on Thursday April 21, 2016 @04:42PM (#11545196)
Why does the device need to be on-premise? Would a Github Enterprise-like setup, where you have a dedicated Kite instance/VPS at their datacenter, work for you?
Re:Kite: Thoughts on Security by fweespee_ch on Thursday April 21, 2016 @04:45PM (#11545217)
Contractual agreements, NDAs, etc. might make it impossible to disclose work product and/or source code to a 3rd party which would include Kite.

> If you're a contract developer, or a developer working full-time for a consulting firm, you might not have the authority to determine for yourself whether it's contractually allowable to upload code to Kite's servers. But if you're working for a pro shop, you can bet every dollar in your pocket that the contracts your firm has with its clients technically prohibit it.

As tptacek said, you might be prohibited and/or not have the authority to do so.

> Why does the device need to be on-premise? Would a Github Enterprise-like setup, where you have a dedicated Kite instance/VPS at their datacenter, work for you?

We run GitLab on-premise so I'm not familiar enough to answer. However, if by "their" you mean Kite? Yeah, that won't work as its essentially the same thing. [e.g. Disclosing it to a 3rd party outside of my control]

Re:Kite: Thoughts on Security by simonw on Thursday April 21, 2016 @05:08PM (#11545362)
GitHub Enterprise allows you to run a dedicated instance on a virtual machine in your own datacenter, which lets you keeps all of your stuff behind your own firewall.
Re:Kite: Thoughts on Security by aaronbasssett on Friday April 22, 2016 @04:45AM (#11547824)
A .kiteignore file would be brilliant. I do a lot of contract work, but also a lot of opensource. My issue with Kite is I would forget to disable it for some projects. If I could have my default project scaffold contain a "*" .kiteignore file it would reduce this fear.
Re:Kite: Thoughts on Security by chinathrow on Friday April 22, 2016 @03:55AM (#11547655)
A major feedback was that folks need that thing and they need it on premise. On the recent update, you left out that folks should contact you at that other mail address, how so?

I can't use Kite if it's not on premise.