61–70 of 120 posts
Edit: The point is that we all have a blind spot around risk assessment and threat evaluation when it comes to certain software topics, such as code editors and terminal software.
Finally. It obviously is something that flies over the heads of most people here at least by reading the comments. This is great.
If I needed a one-time “use it and lose it” attack vector, this would be an excellent way to provide one. Imagine how many thousands of code repositories I could _successfully_ inject a backdoor into, using only a repackaged “without the telemetry” version of Microsoft’s code. Y’all are far too trusting. Edit: The point is that we all have a blind spot around risk assessment and threat evaluation when it comes to cer…
A better method might be to fork VSCode’s repo and modify the build scripts and/or code to remove telemetry.
Earlier quoted context omitted.
Mate that discussion was a year prior to the commit in reference. How can you think it backs up your point? And I assume the commit was made in error because it was immediately reverted and is no longer present in the source. And I do not question the legality, my only assertstion was of the ethicality of taking someone’s mistake and using it to subvert their wishes.
What's this file then? https://github.com/Microsoft/vscode/blob/master/LICENSE.txt
If I needed a one-time “use it and lose it” attack vector, this would be an excellent way to provide one. Imagine how many thousands of code repositories I could _successfully_ inject a backdoor into, using only a repackaged “without the telemetry” version of Microsoft’s code. Y’all are far too trusting. Edit: The point is that we all have a blind spot around risk assessment and threat evaluation when it comes to cer…
Never trust a binary more than you trust the person who built it and the channel you downloaded it through. A better method might be to fork VSCode’s repo and modify the build scripts and/or code to remove telemetry.
If I needed a one-time “use it and lose it” attack vector, this would be an excellent way to provide one. Imagine how many thousands of code repositories I could _successfully_ inject a backdoor into, using only a repackaged “without the telemetry” version of Microsoft’s code. Y’all are far too trusting. Edit: The point is that we all have a blind spot around risk assessment and threat evaluation when it comes to cer…
Never trust a binary more than you trust the person who built it and the channel you downloaded it through. A better method might be to fork VSCode’s repo and modify the build scripts and/or code to remove telemetry.
Never trust a source code repository more than you trust the people who commit it and the channel you downloaded it through.
Autoupdates from a source repository that you don’t review before accepting updates are no safer than autoupdates from a binary source.
Earlier quoted context omitted.
I don’t personally see the need, but the fact that someone can do this should at least once and for all settle how “real” the open-sourceyness of VSCode is.
Some of us want to write code without shipping a bunch of usage data / telemetry / whatever back up to the Mothership. It's the principle of the thing; and anything that shaves off a few clock cycles is fine by me.
This seems to have lead to development of products and features that get a lot of excitement here on HN so maybe it's not all bad.
Earlier quoted context omitted.
Doesn't it suffice to set the following in your User Settings? "telemetry.enableTelemetry": false Honestly I'm very happy to give telemetry data. Microsoft is doing so much to improve the experience, they can make it better with some data.
If you want to send as little data as possible to Microsoft there are other settings to consider: "telemetry.enableCrashReporter": false, "code-runner.enableAppInsights": false, "update.channel": "none", "extensions.autoUpdate": false, "extensions.ignoreRecommendations": true, "workbench.settings.enableNaturalLanguageSearch": false
If I needed a one-time “use it and lose it” attack vector, this would be an excellent way to provide one. Imagine how many thousands of code repositories I could _successfully_ inject a backdoor into, using only a repackaged “without the telemetry” version of Microsoft’s code. Y’all are far too trusting. Edit: The point is that we all have a blind spot around risk assessment and threat evaluation when it comes to cer…