Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VSCodium: Binary releases of VSCode without MS branding, telemetry and licensing

github.com

Post reply on HN
Print view View original

101–110 of 120 posts

Re: VSCodium: Binary releases of VSCode without MS branding, telemetry and licensing

#101

Post by Zancarius »

craftyguy wrote: post #73
floatingatoll wrote: post #67

Earlier quoted context omitted.

Gentoo’s biggest failure to me is in persuading people that building from source is somehow safer than binaries. Never trust a source code repository more than you trust the people who commit it and the channel you downloaded it through. Autoupdates from a source repository that you don’t review before accepting updates are no safer than autoupdates from a binary source.

> Gentoo’s biggest failure to me is in persuading people that building from source is somehow safer than binaries. I don't think this is a big reason Gentoo users use Gentoo. At least not the knowledgeable ones.

> I don't think this is a big reason Gentoo users use Gentoo.

Exactly. The two most compelling reasons to use Gentoo are/were: 1) It's a rolling-release distribution and 2) it offers customization by virtue of building from source. I don't think I've seen the argument that it's more secure--not seriously anyway. I used it back then because I wasn't a huge fan of Linux and Gentoo seemed more familiar to me with its ports analog.

Perhaps part of the OP's confusion is the hardened profile (or similar)? I'm not sure considering their wiki currently advertises it as risk mitigation [1], but I haven't used Gentoo in probably 6-7 years (at least not consistently outside a VM) so my memory on this is likely wrong.

[1] https://wiki.gentoo.org/wiki/Hardened_Gentoo

Re: VSCodium: Binary releases of VSCode without MS branding, telemetry and licensing

#102

Post by filleduchaos »

aikah wrote: post #96
filleduchaos wrote: post #77

Earlier quoted context omitted.

> but I don’t typically feel like shelling out $1000 to buy a machine specifically for an OS I don’t use I keep seeing this argument and it honestly just sounds rather lazy when a few seconds of Googling will point you towards build services you can use without having to purchase a Macbook (for instance, TravisCI has an OS X build environment). Or if you're opposed to cloud-hosted build tools for some reason you coul…

> This whole "well I would if Macs weren't so expensive" sounds like "I just don't want to support macOS" because you have options if you actually were interested. Mac development is a bit more complicated than running MacOS on a CI, especially with GUI apps. And of course code authors prefer compiling programs themselves on their infrastructure. If you want to volunteer and provide a Mac Build then get the source do…

> Mac development is a bit more complicated than running MacOS on a CI, especially with GUI apps.

And this is a cross-platform project that's not exactly Cocoa-heavy (being based on Electron). The person I responded to did not say anything about creating GUIs either, so I am not sure what your point is.

> And of course code authors prefer compiling programs themselves on their infrastructure.

Which is why Travis, Circle, Appveyor and co have zero users, as we all know.

> If you want to volunteer and provide a Mac Build then get the source do it and distribute it

It's almost as if that was one of the things I suggested - working with the requester to provide a binary

> But don't accuse people of being somehow lazy for not supporting mac, that's preposterous.

I said the argument is lazy, not the people. If for some reason (ideological or whatever) you're not interested in supporting macOS, then say so outright. Don't pretend as though the only obstacle between you and distributing your otherwise cross-platform software for macOS is not having a literal Mac in your hands because there are other easy options, like taking on a contributor or using a build service.

Re: VSCodium: Binary releases of VSCode without MS branding, telemetry and licensing

#103

Post by jakear »

yebyen wrote: post #84
jakear wrote: post #79

Earlier quoted context omitted.

The parent of this [1] commit was referenced in a thread linked in this repo's readme. I said this in a different thread, but I'll repeat here: I don't believe the community should be trying to find legal "gotchas" such as this one in order to get around reasonable limitations set in place by a team, else teams will begin to stop using as permissive licenses as they do. This is a matter of ethics for me, as the legal…

If you had linked that comment in your first reply, I would have agreed with you and we probably wouldn't have had any of this to talk about :) A license granted by accident without consideration in return is not a "no takebacks!" situation. If I paid for that license and then you said, it was granted by mistake, I may have a legal leg to stand on in terms of "no takebacks" claims. But if it's just a URL, I'm pretty…

My bad. I follow VSCode closely and incorrectly assumed everyone had gone through the same BFS of the the repository as me.

And yes I don’t mind the URL being public as much as the means by which the legal justification was achineved. Reverse engineering is, in some jurisdictions, totally legal, and it wouldn’t be hard at all to simply look at the requests being made by the application. That I’d be fine with. This sort of underhand “got you!” Is what bothers me.

Re: VSCodium: Binary releases of VSCode without MS branding, telemetry and licensing

#104

Post by redwards510 »

jolan wrote: post #40
carlmr wrote: post #7

Earlier quoted context omitted.

Doesn't it suffice to set the following in your User Settings? "telemetry.enableTelemetry": false Honestly I'm very happy to give telemetry data. Microsoft is doing so much to improve the experience, they can make it better with some data.

If you want to send as little data as possible to Microsoft there are other settings to consider: "telemetry.enableCrashReporter": false, "code-runner.enableAppInsights": false, "update.channel": "none", "extensions.autoUpdate": false, "extensions.ignoreRecommendations": true, "workbench.settings.enableNaturalLanguageSearch": false

Your list is incomplete. From the most recent VSCode changelog @ https://code.visualstudio.com/updates/v1_26#_offline-mode:

Offline mode

Some users do not want any outgoing network requests from VS Code unless they specifically invoke features that require online access. To support this offline mode, we have added new settings to turn off features such as automatic extension update checking, querying settings for A/B experiments, and fetching of online data for auto-completions.

Below is the complete list of settings to control VS Code features that make network requests:

  update.channel
  update.showReleaseNotes
  extensions.autoupdate
  extensions.autocheckUpdates
  extensions.showRecommendationsOnlyOnDemand
  workbench.settings.enableNaturalLanguageSearch
  workbench.enableExperiments
  telemetry.enableTelemetry
  telemetry.enableCrashReporter
  git.autofetch
  npm.fetchOnlinePackageInfo

Re: VSCodium: Binary releases of VSCode without MS branding, telemetry and licensing

#105

Post by userbinator »

josteink wrote: post #91
userbinator wrote: post #89

Earlier quoted context omitted.

How can I, or anyone else for that matter, be sure they are safe to use and represents runtime behavior of the latest ever-changing (read: breaking) OSX? The Hackintosh community has plenty of very knowledgeable individuals who know what they're doing. If someone was trying to pass malware around they would be found out and ostracised very quickly. You can also find the direct links to Apple's servers if you search.…

That’s akin to use hacked or pirated Windows ISOs to build and test Windows-software. And nobody in their right mind would suggest that, right? Why does different rules apply to OSX? Also: DMG-files can’t be used unless you’ve already purchased that $1000 machine you don’t really want/need. It’s completely unsupported in any meaningful sense outside OSX. So more roadblocks. You know how I get a Windows ISO? I downloa…

You'd be surprised how many developers got started in the 90s and early 2000s with a pirated copy of MSVC6...

...and if you've been around and done enough, you would know that "unsupported" doesn't always mean "can't be done". The ones who know it can will hack around, play and investigate, explore the limits, and ultimately become better developers by developing these skills of critical thinking and problem solving. Contrast this with the cookie-cutter developers who won't think beyond what they're told and give up at the slightest difficulty.

I ain't no Apple fan myself but I can sure test something in macOS if I really need to. Give this a read...

https://www.insanelymac.com/forum/topic/329828-making-a-boot...

Re: VSCodium: Binary releases of VSCode without MS branding, telemetry and licensing

#106

Post by PascLeRasc »

Thanks for doing this. This will be the canary that tells us whether Microsoft is really changed like they claim. Since they call themselves "in love with open source" [1] and letting Github "remain an open platform" [2], I expect them to not remove this project from Github. If they do remove it, whatever reason they give about wanting to provide the best possible VSCode experience is bullshit and Github will no longer be a home for open-source projects.

[1] https://info.microsoft.com/rs/157-GQE-382/images/Microsoft-l... [2] https://open.microsoft.com/2018/06/07/github-acquisition-mic...

Re: VSCodium: Binary releases of VSCode without MS branding, telemetry and licensing

#107

Post by jakear »

btinker wrote: post #97
jakear wrote: post #53

Earlier quoted context omitted.

VS Code already provides mechanisms to disable all background network activity.

Are you sure? This is what MS says about it: Data Collection. The software may collect information about you and your use of the software, and send that to Microsoft. Microsoft may use this information to provide services and improve our products and services. You may opt-out of many of these scenarios, but not all, as described in the product documentation. https://code.visualstudio.com/license

You may need to wait for next week’s release. But it is made easy in the current insiders.

Re: VSCodium: Binary releases of VSCode without MS branding, telemetry and licensing

#108

Post by nojvek »

PascLeRasc wrote: post #106

Thanks for doing this. This will be the canary that tells us whether Microsoft is really changed like they claim. Since they call themselves "in love with open source" [1] and letting Github "remain an open platform" [2], I expect them to not remove this project from Github. If they do remove it, whatever reason they give about wanting to provide the best possible VSCode experience is bullshit and Github will no long…

"You can recover from Microsoft and its suppliers only direct damages up to U.S. $5.00. You cannot recover any other damages, including consequential, lost profits, special, indirect or incidental damages."

Lol Microsoft! why a random $5 number?

Re: VSCodium: Binary releases of VSCode without MS branding, telemetry and licensing

#109

Post by PascLeRasc »

josteink wrote: post #44
temp wrote: post #31

Doesn't have the latest build for macOS. :(

Disclaimer: general comment. Not affiliated with project, etc. I don’t know about you, but I don’t typically feel like shelling out $1000 to buy a machine specifically for an OS I don’t use, just to build a binary to non-paying users of free software. If Apple would provide easily installable ISOs for VBox/VMWare installations (or something equivalent), I might bother setting up a build for it. Right now it’s out of…

Thankfully you don't have to do any of that (for any platform), thanks to Travis! https://travis-ci.org/

Re: VSCodium: Binary releases of VSCode without MS branding, telemetry and licensing

#110

Post by OnlyRepliesToBS »

floatingatoll wrote: post #61

If I needed a one-time “use it and lose it” attack vector, this would be an excellent way to provide one. Imagine how many thousands of code repositories I could _successfully_ inject a backdoor into, using only a repackaged “without the telemetry” version of Microsoft’s code. Y’all are far too trusting. Edit: The point is that we all have a blind spot around risk assessment and threat evaluation when it comes to cer…

lol ironic as fuck
Post reply on HN