Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VSCodium – An Open Source Visual Studio Code Without Trackers

fossmint.com

Post reply on HN
Print view View original

111–120 of 265 posts

Re: VSCodium – An Open Source Visual Studio Code Without Trackers

#111

Post by chipperyman573 »

prepend wrote: post #93
jameskraus wrote: post #7

I suspect the tracking in VSCode is mainly used to improve the product. It's probably in my best interest, and the interest of the community as a whole to leave tracking on. I mean, I get it, HN is usually a more skeptical and security-focused crowd. At the same time, it's likely MS will just take that information and tailor their bugfixes and features to the things I need most, so by all means I want them to have it…

I think you’re right, but it needs to be a user choice. If presented with an option, I would likely leave it turned on 90% of the time. I hope this project motivates MS to open source the runtime and making tracking a user- selected option. I really like Code and think MS has really helped the dev community by making it so great and free. But I would like to see them embrace f/l/oss for all their non-core products an…

Isn't it? When I opened VS Code on a new computer for the first time today, a message popped up with step by step instructions to opt out

Re: VSCodium – An Open Source Visual Studio Code Without Trackers

#112

Post by zeusk »

userbinator wrote: post #107
Stuckinsofa wrote: post #96

Earlier quoted context omitted.

Can you explain why this search feature is a problem because I don't understand?

Maybe not understanding the problem with a tool that may be used to work on proprietary code containing trade secret information silently and unexpectedly sending information out to the Internet is the reason for software becoming spyware...

Emphasizing from my original post,

>> it only does this on the (VSCode) settings file and not on other files ;)

Re: VSCodium – An Open Source Visual Studio Code Without Trackers

#113

Post by eridius »

paavoova wrote: post #32
timdorr wrote: post #3

Is this needed? You can disable telemetry from the settings: https://code.visualstudio.com/docs/supporting/FAQ#_how-to-di...

This has been an issue in the past: https://github.com/Microsoft/vscode/issues/16131 Telemetry not being disabled I have disabled telemetry as described in the FAQ. I have set the following properties in the settings: [..] Now despite of this, when I log my network traffic (with Wireshark) I can see that Visual Studio Code periodically contacts vortex.data.microsoft.com. For the record, Even with: [..] I still see co…

I just read through that issue, I see nothing wrong with the responses. First was an acknowledgement that when opted out they were still sending an unnecessary "user opted out" telemetry event and that it would be removed. Then indicating that subsequent network connections were for update checking, and extension update checking, and finally an explanation that while they can disable telemetry in the app, they can't control any telemetry that extensions may be doing, and promised that they're working hard to ensure any extensions created by their team and other teams in general do the right thing, but as they don't control that code there's not a whole lot they can do.

I suppose it's not clear why vortex.data.microsoft.com is still on the list of servers being contacted at this point, but it seems quite plausible that this is coming from an extension.

Re: VSCodium – An Open Source Visual Studio Code Without Trackers

#114

Post by beefsack »

jameskraus wrote: post #7

I suspect the tracking in VSCode is mainly used to improve the product. It's probably in my best interest, and the interest of the community as a whole to leave tracking on. I mean, I get it, HN is usually a more skeptical and security-focused crowd. At the same time, it's likely MS will just take that information and tailor their bugfixes and features to the things I need most, so by all means I want them to have it…

Even with the best intentions at heart, do you trust them not to accidentally leak sensitive information about you through their telemetry? There are so many places a "phone home" system could either be compromised, or accidentally send more than it should.

Telemetry is used either with naivety or malice. There is always some risk to the user.

Re: VSCodium – An Open Source Visual Studio Code Without Trackers

#115

Post by quzyp »

rl3 wrote: post #41

Is there any difference between this and the version in Arch's community repo?[0] Obviously VSCodium appears to target more distros. From my experience code (Arch) is entirely debranded, so I can't imagine telemetry was left in. [0] https://www.archlinux.org/packages/community/x86_64/code/

Is it? I honestly never had a closer look, but the upstream url just points to the regular MS github repo.

Re: VSCodium – An Open Source Visual Studio Code Without Trackers

#116

Post by h1d »

false-mirror wrote: post #17
timdorr wrote: post #3

Is this needed? You can disable telemetry from the settings: https://code.visualstudio.com/docs/supporting/FAQ#_how-to-di...

1. One less setting to configure, lest the Default monsters gets you 2. VSCodium is just a FLOSS VSCode binary. You could build it yourself from the available VSCode source. However, the VSCode binary is not FLOSS so you cannot be sure what it is running. It's not like VS code is the next PRISM-- I'm sure MS has better ways to spy on users ;). The real pull is whether you prefer FLOSS by default.

It's kind of funny because now you're trusting some third party not to inject unwanted code when you just blindly download binary on every release anyway.

Seems to just bring another problem by trying to solve one.

Re: VSCodium – An Open Source Visual Studio Code Without Trackers

#117

Post by userbinator »

There's already a comment here, and I've also personally experienced just from talking with others offline, that a lot of people don't even know VSCode had telemetry, despite it mentioned several times in the product itself and its documentation. They (and remember, these people are supposedly developers) either ignored it, or just didn't read the docs.

I guess a big WARNING banner might scare users away, but it's still a bit disturbing to see such a lax attitude towards tools which developers use to work with a software company's most valuable assets. A lot of people, developers included, don't really read EULAs, and it's the same reason (traditional) spyware could thrive: no doubt they all specify in their license agreements the fact that they all collect information, but approximately no one reads those.

Put it another way, would you want your compiler or other parts of your toolchain sending information about all the source files it processed? I wouldn't consider myself particularly paranoid when it comes to security, maybe even looser than the average on HN, and even then I wouldn't use such tools. I wonder how many companies have already banned their use...

Re: VSCodium – An Open Source Visual Studio Code Without Trackers

#118

Post by userbinator »

zeusk wrote: post #112
userbinator wrote: post #107

Earlier quoted context omitted.

Maybe not understanding the problem with a tool that may be used to work on proprietary code containing trade secret information silently and unexpectedly sending information out to the Internet is the reason for software becoming spyware...

Emphasizing from my original post, >> it only does this on the (VSCode) settings file and not on other files ;)

Starting with "Lol, probably just an oversight" and ending with an emoticon is excessively dismissive and flippant... that's how you lose customers, or potential ones.

Re: VSCodium – An Open Source Visual Studio Code Without Trackers

#119

Post by pitaj »

beefsack wrote: post #114
jameskraus wrote: post #7

I suspect the tracking in VSCode is mainly used to improve the product. It's probably in my best interest, and the interest of the community as a whole to leave tracking on. I mean, I get it, HN is usually a more skeptical and security-focused crowd. At the same time, it's likely MS will just take that information and tailor their bugfixes and features to the things I need most, so by all means I want them to have it…

Even with the best intentions at heart, do you trust them not to accidentally leak sensitive information about you through their telemetry? There are so many places a "phone home" system could either be compromised, or accidentally send more than it should. Telemetry is used either with naivety or malice. There is always some risk to the user.

The telemetry code is in the source. You can look at it yourself. It's anonymized.

Re: VSCodium – An Open Source Visual Studio Code Without Trackers

#120

Post by paavoova »

eridius wrote: post #113
paavoova wrote: post #32

Earlier quoted context omitted.

This has been an issue in the past: https://github.com/Microsoft/vscode/issues/16131 Telemetry not being disabled I have disabled telemetry as described in the FAQ. I have set the following properties in the settings: [..] Now despite of this, when I log my network traffic (with Wireshark) I can see that Visual Studio Code periodically contacts vortex.data.microsoft.com. For the record, Even with: [..] I still see co…

I just read through that issue, I see nothing wrong with the responses. First was an acknowledgement that when opted out they were still sending an unnecessary "user opted out" telemetry event and that it would be removed. Then indicating that subsequent network connections were for update checking, and extension update checking, and finally an explanation that while they can disable telemetry in the app, they can't…

I used past tense, and the parent comment I replied to writes "just disable the telemetry", linking to the same FAQ the OP of the linked issue tried to follow to disable telemetry.

The VSCodium docs (linked in an above comment) mentions baked-in telemetry. Presumable this refers to the binaries rather than the source code, but then the issue is two-fold, being telemetry in the source and telemetry Microsoft may insert into the binaries. So following some FAQ to disable telemetry will not address the latter if you're not building from source.

Post reply on HN