Hacker News Reader

Comment by timdorr | Hacker News Reader

Is this needed? You can disable telemetry from the settings: https://code.visualstudio.com/docs/supporting/FAQ#_how-to-di...

View on HN

1. One less setting to configure, lest the Default monsters gets you

2. VSCodium is just a FLOSS VSCode binary. You could build it yourself from the available VSCode source. However, the VSCode binary is not FLOSS so you cannot be sure what it is running.

It's not like VS code is the next PRISM-- I'm sure MS has better ways to spy on users ;). The real pull is whether you prefer FLOSS by default.

How do we know the build of VSCodium is what they say it is? Aren't we in the exact same situation as with using the MS version, except we know even LESS about the maintainers?

> However, the VSCode binary is not FLOSS so you cannot be sure what it is running.

That's equally true of the VSCodium binary. It's not a reproducible build, I have no way of knowing from which source code the binary was generated.

Of course I could build from source, but VSCodium is just VSCode built from source with a build flag set. So in this regard it's not contributing anything notable (and doesn't claim so either).

Why is it not possible to build VSCodium in a reproducible way? Does it download packages while building?

I think this kind of reproducible:

* https://reproducible-builds.org

* https://en.wikipedia.org/wiki/Reproducible_builds

Sorry, but I don't think I am qualified to explain clearly

It's kind of funny because now you're trusting some third party not to inject unwanted code when you just blindly download binary on every release anyway.

Seems to just bring another problem by trying to solve one.

VSCode initializes the module they use to collect telemetry (Application Insights / A.I.) even if you disable that setting [1].

1. https://github.com/Microsoft/vscode/issues/63404

They explicitly created a tech debt issue to fix that, seem reasonable to me?

Been open for 5 months though. Doesn’t look that privacy is high up on their priority list.

According to their docs, even VSCodium doesn't get all the telemetry out.

https://github.com/VSCodium/vscodium/blob/master/DOCS.md#dis...

And it's possible to opt out on install... It's not like hidden or anything

You got an installer with yours?!

They're probably using Windows.

It’s easy to forget just how many things require an installer-wizard-type process on Windows after being on macOS and Linux for a few years.

Very few things, if any, REQUIRE an installer on Windows; it's just common (and annoying) that most software is distributed this way for that platform.

I for one prefer that the developer of an application takes responsibility for its installation. That way you can blame them if it does not work. On Linux distros many packages are close to uselesss because they are outdated or have been modified in weird ways incompatible with tutorials and documentation. This is especially true for all scientific software.

I prefer that all my software is installed and updated in one fell swoop, with one single package manager, instead of requiring myriad installers, uninstallers, and update daemons that run in the background for practically each and every program, just sitting there wasting CPU cycles.

If you dislike outdated software, try switching to a Testing or Unstable version of your operating system, or choosing a distro that packages less conservatively (Arch or Fedora, for instance).

Distribution maintained packages are a really bad idea. You start to realize this once you are not in control of the box you are working on (have no root access). Suddenly you are faced with CentOS 6.5 because some proprietary piece of software depends on a specific gcc version / libc version. Or you can't upgrade the cluster easily because parts of the legacy code depends on specific package versions (boost, gcc). So people invent Spack and before that modules just so that they don't have to depend on the specific package versions they are stuck with. macOS and windows got it right, just distribute all dependencies that you need and don't make any assumptions on the underlying system. Everything else sucks and Linux is a prime example of that.

In short: Once you've worked with a large enough number of nighmarish Linux installations, you treat them as adversarial systems and wish you could install software just by clicking through a few screens.

I understand that you feel powerless and miss your own home PC where you are free to do what you like. However, the same could be true for software where you install by clicking if someone locked it so that you don't have administrator access and then neglected the system.

I don't know about macOS, but doesn't most software on Linux require installation? I think the most common ways to distribute software are (1) as a package for your distribution's package manager (which the package manager installs, typically requiring superuser privileges), (2) as source code that you make & install, (3) as prebuilt binaries that you are meant to unpack and install. "Unpack and run from where they are" binaries do of course exist but aren't they less common than those 3 other types?

Installation yes; installer no. To install VSCode on Debian, you would add the apt repository to your apt configuration, run apt update && apt upgrade, then apt install ______. On Windows, most software comes in the form of an installer instead of being installed with a system package manager.

The difference is whether you have to click through one of those wizard things to get the program you want.

Telemetry is reset to enabled on every update, don't forget to change every time.

Hasn't happened for me. No update has ever touched my user settings.

Not for me. I remember disabling it after first install, now I checked (panicking after reading your comment) and it's still disabled even after many updates in between. Ubuntu.

They know it. They just don't trust Microsoft.

That's mighty dissonant and hypocritical of them to use and benefit from Microsoft's work and investment, and claim that their telemetry is the part they don't trust.

Haha indeed. Besides, this is opensource and one can build it from source anytime. Using emotionally charged language to sell a trivial product.

VSCode is OSS right? So microsoft’s Work and Investment was specifically designed to be reused without any direct financial compensation.

I don’t quite understand your point. Do you think that it’s hypocrtical to use and benefit from OSS work and investment? It seems important to respect the creator’s intent and if software is released under an OSS license it’s not dissonant or hypocritical or bad to reuse, or even make money under many licenses. It’s a feature, not a bug.

In the 90s there used to be these companies that sold “internet in a box” in waldenbooks and other stores in the US. It was about $70 but it was all just OSS stuff- trumpet winsock, Eudora, mosaic, etc. I thought it was really crazy because it’s all available for free. One day I was in line behind an old guy who was buying it and he was so happy because it was conveniently packaging everything together and he had no idea how to bootstrap all these tools onto his PC. OSS is designed to allow this.

This is a clear case of people exploiting and perpetrating FUD (fear, uncertainty and doubt), riding on Microsoft's historic reputation as not being trustworthy, and turning it to their private benefit.

If you have trust issues with Microsoft, you shouldn't be using software authored by them, as software can have backdoors and security issues hiding in plain sight (heart bleed bug, for instance).

Atom has/had the exact same kind of telemetry, but hasn't attracted this type of hysteria, because GitHub wasn't Microsoft. This is all plain and simple dogma.

I think this is why OSS helps to reduce fud. Clearly showing the source that produces telemetry and providing a district that doesn’t use it, and can clearly be built for source is the best way, I think, to reduce fud. MS gets more than others because of their history and size.

You do realize VSCode's built on top of things like Electron, Node, V8 etc. It's a lot of work done by other people to enable MS to build VSCode in this way.

So why is it problematic now for other people to build on top of what Microsoft added?

I hope you see that writing millions of lines of original source code on top of (Election, node, v8,..) and investing tens of engineers at millions per year in cost, to create VSCode is not equivalent to disabling telemetry and slapping a non Microsoft label on it.

There's absolutely zero problems with people using OSS as intended. But for me personally, as I stated in the original parent comment, value obtained by persisting with Microsoft's VSCode, despite telemetry, is worth continuing to use it, as against an entity's fork whose USP is furthering unfounded FUD.

They're not trying to hide/deny it's Microsoft's VSCode. It's called VSCodium, inspired by Google Chrome/Chromium, after all. As for it being FUD, being concerned over OPT-OUT telemetry is for many not FUD, but to each their own.

So they have you install a binary that you can't inspect the source to or build on your own? I'm confused.

It clearly states in the article that though VSC is open source and you can build it from source, there are opaque components that are part of the VSC installer. The article claims that the installer installs telemetry systems, though they can be opted out of. However, the project owners do not trust Microsoft to honor the 'opt-out' part if not now then in the future.

So they have created a fork of the project.

Why in the hell would anyone trust them?

Why in the hell would I trust anyone telling me not to trust them?

That makes no sense. You are moving from trusting Microsoft, which has actual skin in the game, to random people on the Internet that don't.

Plus Microsoft. Because it's still their code underneath it all. So it's not like VSCodium actually solves anything...

But you trust these random people?

Honestly, yes. More than Microsoft.

Why would trust them? honest question. VSCode is more transparent as any other open source project it can be, yet people still have that Microsoft stigma for years ago. To me is just blatant paranoia.

I would not trust an installer from a third party without knowing what was really changed, that's scary as hell if you ask me. Just look at the bootstrap 4 backdoor that was introduced but luckily was caught.

Ah, that's because you are on an untrusted platform in the first place. There is no "installer" on ubuntu, so it's actually easy to verify if the package we got really came from the sources we see in github. But vscode packages are explicitly different from the code by those proprietary additions during build. We have to trust them that they only add telemetry. One very important feature of open-source is that you don't have to trust. Adding this proprietary blackbox completely removes that factor. Not to mention, I really don't want telemetry on my code and this wouldn't be the first time Microsoft let you disable something only to be later revealed that it was still sending.

Yes it is - tracking that you have to opt-out of is evil (regardless of how well intentioned the tracking is).

But how do the PMs at Microsoft figure out new features without user data?

How did anyone write software for decades before everything was connected to the internet?

Less effectively and at greater expense (with regards to understanding how large swathes of your userbase use your software in practice)

The lack of detailed usage monitoring resulted in more useful software that didn't cater to the lowest common denominator.

Telemetry lets you shed all the baggage of supporting the minority.

That’s a bold claim. If the tool is made more useful for majority of the people using it is necessarily not a bad thing.

The Americans with Disabilities Act, which can be used to sue developers of inaccessible websites, has made it clear that in some cases serving the majority can be a bad thing.

Less severely, there's an awful lot of long tail business productivity served by obscure software features that is very difficult to satisfy with modern hyper-engagement-optimized tools.

I'm pretty sure there are false dichotomies going on here.

Software products may be developed for a mass audience or they may be developed for a narrow niche.

In either case, making the product accessible to people with disabilities is something developers should try to do.

And in every case, having data on user behaviour, software performance, bugs, crashes, etc, will enable the developer to do a better job of catering to their users' needs.

Have I missed something about how these objectives must be mutually exclusive?

There is NO telemetry in Linux (the kernel) and may other great software. I'm sorry but "less effectively" and "greater expense" is just your opinion

> I'm sorry but "less effectively" and "greater expense" is just your opinion

No need to be sorry, it is pretty obvious that it is my opinion, since I made no attempt to support the statement, that is all it could be. That said, it would have been more polite to ask me why I believe what I wrote rather than being dismissive.

> "less effectively" ... "greater expense"

I feel that in order for me to provide satisfactory support of my claim to you, we'll have to first agree upon a strict definition of these terms. You're right to call them out in quotes as my use of them was intended to be qualitative and informal. How about more "effective" development being development that is more focused on serving the needs of its users & the goals of its developers, and "expense" include direct monetary cost, manpower, and any other resources whose use incurs an opportunity cost?

> There is NO telemetry in Linux (the kernel) and many other great software.

1. As I mentioned above, my comment was informal. It was not intended to make a strong claim about all software, without exception.

2. Unless a majority of pre-internet software was developed as effectively and cheaply as Linux and the other software you were thinking of, it is possible that my claim is still correct in the general case.

3. Software used primarily by those who actively contribute to it (such as Linux during its early development) has a very different communication dynamic from other software.

4. Linux is not representative of software developed pre-internet, considering the project was first announced by Linus in the comp.os.minix newsgroup in 1992[1]

* To be clear, any additional claims I have made above are _also_ my opinion.

[1] https://www.cs.cmu.edu/~awb/linux.history.html

That's a different question. It's about feedback on what to improve, not about writing software.

Surveys.

There might be some people in their own company who are users of software development tools and could give informed feedback.

It doesn't works, you can search the proof in vscodium issues(keyword: little snitch). It's the main reason why regex are used in CI pipelines to clean MS code from telemetry servers.

This has been an issue in the past: https://github.com/Microsoft/vscode/issues/16131

Telemetry not being disabled I have disabled telemetry as described in the FAQ. I have set the following properties in the settings: [..] Now despite of this, when I log my network traffic (with Wireshark) I can see that Visual Studio Code periodically contacts vortex.data.microsoft.com.

For the record,

Even with: [..] I still see connection attempts by Visual Studio Code to marketplace.visualstudio.com and vortex.data.microsoft.com at startup.

Response is: I'm pretty sure we [VS Code Core] are doing the right thing here and we would love any pointers (all code is OSS).

Which almost sounds like a complete deflection of the issue. The ticket was locked.

This comment states that's the auto updater endpoint, not telemetry.

https://github.com/Microsoft/vscode/issues/16131#issuecommen...

Though there's no explanation for why VS Code continues to ping vortex.d.m.c even after updating is disabled. Hmmm.

That comment is replying to another post by bsr203, not the OP.

I just read through that issue, I see nothing wrong with the responses. First was an acknowledgement that when opted out they were still sending an unnecessary "user opted out" telemetry event and that it would be removed. Then indicating that subsequent network connections were for update checking, and extension update checking, and finally an explanation that while they can disable telemetry in the app, they can't control any telemetry that extensions may be doing, and promised that they're working hard to ensure any extensions created by their team and other teams in general do the right thing, but as they don't control that code there's not a whole lot they can do.

I suppose it's not clear why vortex.data.microsoft.com is still on the list of servers being contacted at this point, but it seems quite plausible that this is coming from an extension.

I used past tense, and the parent comment I replied to writes "just disable the telemetry", linking to the same FAQ the OP of the linked issue tried to follow to disable telemetry.

The VSCodium docs (linked in an above comment) mentions baked-in telemetry. Presumable this refers to the binaries rather than the source code, but then the issue is two-fold, being telemetry in the source and telemetry Microsoft may insert into the binaries. So following some FAQ to disable telemetry will not address the latter if you're not building from source.

> and telemetry Microsoft may insert into the binaries.

This is the main problem as I see it and MS hasn't been transparent in question on what can actually be added to the binaries which bring us to the necessity of fork such as VSCodium.

How much data does it send before giving you the opportunity to opt-out? I'm assuming a lot more than any privacy respecting application sends. If they were serious, it would be opt in.

Thanks. I didn’t know that you can disable it.

Reply on news.ycombinator.com