111–120 of 120 posts
H̶m̶m̶,̶ ̶t̶h̶i̶s̶ ̶w̶i̶l̶l̶ ̶n̶o̶t̶ ̶f̶l̶y̶ ̶:̶)̶ ̶ I̶'̶m̶ ̶p̶r̶e̶t̶t̶y̶ ̶s̶u̶r̶e̶ ̶y̶o̶u̶ ̶c̶a̶n̶'̶t̶ ̶j̶u̶s̶t̶ ̶s̶t̶r̶i̶p̶ ̶t̶h̶e̶ ̶l̶i̶c̶e̶n̶s̶e̶ ̶o̶f̶ ̶a̶ ̶s̶o̶f̶t̶w̶a̶r̶e̶ ̶a̶n̶d̶ ̶r̶e̶l̶e̶a̶s̶e̶ ̶i̶t̶ ̶u̶n̶d̶e̶r̶ ̶t̶h̶e̶ ̶t̶e̶r̶m̶s̶ ̶y̶o̶u̶ ̶w̶i̶s̶h̶ ̶i̶t̶ ̶h̶a̶d̶.̶ ̶ ̶h̶t̶t̶p̶s̶:̶/̶/̶c̶o̶d̶e̶.̶v̶i̶s̶u̶a̶l̶s̶t̶u̶d̶i̶o̶.̶c̶o̶m̶/̶l̶i̶c̶e̶n̶s̶e̶ ̶ ̶"̶Y̶o̶u̶ ̶m̶a̶y̶ ̶n̶o̶t̶.̶.̶.̶ ̶s̶h̶a̶r̶e̶,̶ ̶p̶u̶b̶l̶i̶s̶h̶,̶ ̶r…
Thanks for doing this. This will be the canary that tells us whether Microsoft is really changed like they claim. Since they call themselves "in love with open source" [1] and letting Github "remain an open platform" [2], I expect them to not remove this project from Github. If they do remove it, whatever reason they give about wanting to provide the best possible VSCode experience is bullshit and Github will no long…
"You can recover from Microsoft and its suppliers only direct damages up to U.S. $5.00. You cannot recover any other damages, including consequential, lost profits, special, indirect or incidental damages." Lol Microsoft! why a random $5 number?
Thanks for doing this. This will be the canary that tells us whether Microsoft is really changed like they claim. Since they call themselves "in love with open source" [1] and letting Github "remain an open platform" [2], I expect them to not remove this project from Github. If they do remove it, whatever reason they give about wanting to provide the best possible VSCode experience is bullshit and Github will no long…
If I needed a one-time “use it and lose it” attack vector, this would be an excellent way to provide one. Imagine how many thousands of code repositories I could _successfully_ inject a backdoor into, using only a repackaged “without the telemetry” version of Microsoft’s code. Y’all are far too trusting. Edit: The point is that we all have a blind spot around risk assessment and threat evaluation when it comes to cer…
Earlier quoted context omitted.
They can't be distributed in distro package managers which usually require everything to be foss.
Depends on the distro. For the main Debian repos, it's true. Others like Arch are more lenient, e.g. Arch packages the Steam client.
[visual-studio-code-bin](https://aur.archlinux.org/packages/visual-studio-code-bin/): Original binary from Microsoft
[code](https://aur.archlinux.org/packages/code/): Build from latest release source code
[code-git](https://aur.archlinux.org/packages/code-git/): Build from latest Git commit
The versions that build from source (`code` and `code-git`, AFAIK have telemetry disabled).
Earlier quoted context omitted.
VS Code already provides mechanisms to disable all background network activity.
Defaults matter. They matter even more given Microsoft's demonstrated history of quietly adding new telemetry and metrics which are enabled. I have no skin in this particular game, but I'm glad to see the work being done.
I don't see the beneficial element to this project. Visual Studio Code is opensource, free of charge and used by millions at this point, why would anyone want another license just because of the license alone?
The VSCode binary release is not open source and not redistributable but rather "source available", and "free of charge" doesn't confer "freedom to tinker". VSCode does have costs associated with it's use, specifically its users' privacy, which they give up by agreeing to Microsoft's data collection terms. You may not value your freedom to tinker or your right to privacy, but the people who run and use this project d…
I guess that’s why this project is called VSCodium.
I don't see the beneficial element to this project. Visual Studio Code is opensource, free of charge and used by millions at this point, why would anyone want another license just because of the license alone?
The source license and binary distribution license are different. The source code is MIT licensed; nothing wrong with that. Great license for this. The binaries are provided with a different license that also covers components from third parties that may not be in the vs code repo as well as telemetry and other data gathered. If for whatever reason you don't like this license, you can build from source. This project…
Earlier quoted context omitted.
That’s akin to use hacked or pirated Windows ISOs to build and test Windows-software. And nobody in their right mind would suggest that, right? Why does different rules apply to OSX? Also: DMG-files can’t be used unless you’ve already purchased that $1000 machine you don’t really want/need. It’s completely unsupported in any meaningful sense outside OSX. So more roadblocks. You know how I get a Windows ISO? I downloa…
You'd be surprised how many developers got started in the 90s and early 2000s with a pirated copy of MSVC6... ...and if you've been around and done enough, you would know that "unsupported" doesn't always mean "can't be done". The ones who know it can will hack around, play and investigate, explore the limits, and ultimately become better developers by developing these skills of critical thinking and problem solving.…
Sure, but that was the 90s. Now everyone in the world is connected to the same network, and any security flaw can have critical, global consequences.
Basically, having a "wormable" build and deployment pipeline may have been tolerated back then, but it sure isn't now.
> and if you've been around and done enough, you would know that "unsupported" doesn't always mean "can't be done"
Yes, I'm sure it can be done.
> The ones who know it can will hack around, play and investigate, explore the limits, and ultimately become better developers
That's disingenuous. You only have so much time available, and you cannot do everything which is technically possible. You have to prioritize.
My free and underfunded open-source projects are going to invest the efforts I have capacity for into making a better product for the users, not learning all the ins and outs of running a pirated OS on hardware Apple clearly doesn't want it to run on.
Basically: My point was Apple is putting up lots of roadblocks which no other OS-vendor is, and that if they stopped doing that, maybe you'd see more projects bothering to support MacOS as a build-target.
And really... As a user, would you be happy to be told that the software you are asked to install and trust was built on a hacked OSX copy downloaded from the internet which the developer has no way of verifying if is trustworthy or not? I'm going to assume not.
So why are you making the argument that developers should do just that?
Earlier quoted context omitted.
> Gentoo’s biggest failure to me is in persuading people that building from source is somehow safer than binaries. I don't think this is a big reason Gentoo users use Gentoo. At least not the knowledgeable ones.
> I don't think this is a big reason Gentoo users use Gentoo. Exactly. The two most compelling reasons to use Gentoo are/were: 1) It's a rolling-release distribution and 2) it offers customization by virtue of building from source. I don't think I've seen the argument that it's more secure--not seriously anyway. I used it back then because I wasn't a huge fan of Linux and Gentoo seemed more familiar to me with its po…