Hacker News Reader

Comment by 013a | Hacker News Reader

Is there any technical evidence that Microsoft is doing something suspicious with the binaries? Differing hashes? Weird network traffic? Binary de-compilation? Its not hard to find evidence if you've got a hunch, instead of publishing a fear piece like this.

View on HN

The license forbids you to reverse-engineer, so how would you find out without breaking the license?

You can download the .deb/.rpm without accepting the license.

Come on, nobody is preventing anyone from running the binary with strace or with wireshark open and comparing it to a version compiled from their sources. It's absolutely something which would've been relevant in a post like this one.

None of that would fall under ‘reverse engineering’ in this context since those techniques are basic due diligence that would be required before running software from a disreputable source like Microsoft.

I strongly agree, as I said in the article by license using VSC your renounce your rights to reverse-engineer the VSC. So you take a legal risk making it and blogging/talking/podcasting about it on Internet and can face legal actions.

I’m certain the community would be very surprised if Nadella’s “OSS is good” Microsoft tried to go after an independent research post citing that clause. It’s there so they have some legally valid substance to roll with if they want to go after a significant case. Say, Jetbrains implementing something that blatantly seems to have been inspired by reverse engineering a proprietary part of VSCode. Not a good example and VSCode’s proprietary bits are so minor it probably isn’t worth pursuing but it should highlight the difference. Keep in mind too it could gain more proprietary features in future, added without needing to update the EULA and bothering users with Yet Another Policy Update they have to agree to.

Simple: you don't accept a license. If you want to reverse engineer it, just do it. You don't need their permission.

Reverseenigneering might be forbidden in the united states. In many other countries however it isn't, especially for those cases, where you aren't trying to steal a product but to learn/research something about it

It is a fear piece, but the premise that the binary is not MIT-licensed is true. This is the same for the dotNET core binaries, they don't have the same license as the source either. Now I think of it, this probably applies to most open-source libraries including ASP.NET MVC. Perhaps because they use hardware-based signing of the binary?

>It is a fear piece,

Why, you are even forbidden to reverse engineer or hack the binary so it is the total opposite of free software.

Any idea why would they put this limitations on the binaries? What does MS gains for this ?

What it gains is the ability to include some proprietary bits, including their branding, the extension system, and the option to send telemetry back.

Just the same reason that the chrome binary isn't open source. Though MS doesn't make it's money on personal information, so the telemetry part is much more restricted.

>telemetry part is much more restricted

Are you saying that Microsoft is collecting less information than Google would in the same situation? I find that very hard to believe looking at Microsoft's history. Do you have anything to back it up? The only comparison I can come up with is Windows 10 versus ChromeOS.

Here's google's quarterly 10-Q statement.[1]

"We generate revenues primarily by delivering relevant, cost-effective online advertising." For the quarter ending June 2018, google advertising revenues were $28,087 million, out of $32,657 million total. That's 86% of their total revenue, for those keeping score at home.

Here's the relevant section of Microsoft's financial statement for the same time period. Advertising revenue is $6,100 million, out of $36,400 million. That's 17%. Microsoft doesn't even include the figure as a sub-line item, because their money makers are Azure and Office 365.

I understand that MS has a history of being the great opponent to software freedom. I understand that they've made moves that are anti-developer, and anti-customer in some ways. But their business model has never been based on collecting information. It was based on selling licenses, and now it's based on paid PaaS and SaaS.

With that in mind: it's hard to compare giant, decades-old corporations like this. We will inevitably come up with an incomplete list of anti-privacy things that both have done. But the profit motive lines up pretty clearly here.

But because I can't resist... google privacy issues have a wikipedia page: https://en.wikipedia.org/wiki/Privacy_concerns_regarding_Goo... . There is no analogous page about Microsoft privacy issues.

[1] https://www.sec.gov/Archives/edgar/data/1652044/000165204418...

[2] https://www.microsoft.com/en-us/Investor/earnings/FY-2018-Q4...

Telemetry is added in the Microsoft code for sure, plus some suggestions to Microsoft extensions.

Reply on news.ycombinator.com