Hacker News Reader

Comment by fgonzag | Hacker News Reader

Why would you remove the MS branding? Does it somehow hurt your privacy to acknowledge who the developer and sponsor is?

View on HN

It's not about removing the MS branding.

MS does not allow their branding to be distributed in unofficial builds. So if you want a custom build of VS Code, you are required to swap out the branding.

> Why would you remove the MS branding?

Barely-educated guess based on Debian / Mozilla stances on the matter: un-branding an OSS project can be necessary to avoid trademark infringement.

edit re sibling comment: yup, the MIT licensed code provided by microsoft is apparently unbranded (i.e. it wasn't "removed"). This is almost certainly done for trademark protection.

Just like IceWeasel on Debian. Can use the code, can't (necessarily) use the name.

Answered in the github repo itself: https://github.com/VSCodium/vscodium#why

This link does not answer the question.

It does but not very clearly.

  Therefore, you generate a 'clean' build, without the Microsoft customizations, which is by default licensed under the MIT license

Microsoft customizations include their branding

That doesn't answer 'why' at all.

Yes, it does. The build cannot use the Microsoft branding.

> This repository contains build files to generate free release binaries of Microsoft's VSCode. When we speak of "free software", we're talking about freedom, not price.

> Microsoft's downloads of Visual Studio Code are licensed under this not-FLOSS license and contain telemetry/tracking. According to this comment from a Visual Studio Code maintainer:

> When we [Microsoft] build Visual Studio Code, we do exactly this. We clone the vscode repository, we lay down a customized product.json that has Microsoft specific functionality (telemetry, gallery, logo, etc.), and then produce a build that we release under our license.

> When you clone and build from the vscode repo, none of these endpoints are configured in the default product.json. Therefore, you generate a "clean" build, without the Microsoft customizations, which is by default licensed under the MIT license

> This repo exists so that you don't have to download+build from source. The build scripts in this repo clone Microsoft's vscode repo, run the build commands, and upload the resulting binaries to GitHub releases. These binaries are licensed under the MIT license. Telemetry is disabled.

> If you want to build from source yourself, head over to Microsoft's vscode repo and follow their instructions. This repo exists to make it easier to get the latest version of MIT-licensed VSCode.

> Microsoft's build process (which we are running to build the binaries) does download additional files. This was brought up in Microsoft/vscode#49159 and Microsoft/vscode#45978. These are the packages downloaded during build"

That's the entire contents of the link. Which part of that do you think explains why they don't use Microsoft branding?

> none of these endpoints are configured in the default product.json

Literally all it says is that by default it doesn't use Microsoft branding. It never says 'why'. At all.

I didn't post the original link. MS collects analytics - which I am not comfortable with. Capability matters and intentions can change later. :)

You could always just set `telemetry.enableTelemetry` to false and continue to use the official builds.

But only if you trust Microsoft to honour that setting indefinitely, and not for example to just change it back later or hide something shady behind another option instead. At this point, a lot of people understandably don't.

It's open source. You could see for yourself. lol

Sure, and then you could check again every time there is an update. But why bother, when there is already an uncontaminated version readily available to solve this problem for you?

How do you know it is uncontaminated without looking at the source code?

Technically you don't, just like any other software, but the risk is surely significantly lower since everyone including Microsoft is saying that what Microsoft is doing is taking that same code and then adding its contaminants on top.

VSC sends telemetry after first run, so there's no big sense to do it.

Also you can't block telemetry by Windows firewall.

P.S. Proud hoster of VSCodium Linux repo https://gitlab.com/paulcarroty/vscodium-deb-rpm-repo

That can be true for almost all software then?

Sure, but almost all software is not produced by a giant corporation with a well-established track record of pushing user-hostile changes via updates, including overriding or reverting the user's explicitly chosen privacy settings, and including taking such actions in the recent past.

Microsoft is not on your side when it comes to privacy and data security. It has made this abundantly clear both by its actions and by the statements of its senior leadership. However much anyone here might like VS Code, it is still a Microsoft product, while the alternative under discussion is not.

I'm genuinely surprised so many people seem to be leaping to the defence of VS Code here. Why? It's the same application, just made worse by Microsoft's telemetry (and the accompanying infamously opaque privacy policies). Unless you need one of the extensions that is tied specifically to the official Microsoft version, why wouldn't you go with the safer option?

I'm not defending MS just curious. Safer option is not convinent by any means. The fork linked is also open to malicious behaviour. The maintainer can sneak in any code, issues we seen similar to npm.

So if you feel this way about MS then you cant be on Windows. Apple have also been known to report users location secretley on iPhones. I'm on OSX and i dont entirely trust them either. Theres too many holes here, really have to patch them all if this is the stance we are taking.

Theres too many holes here, really have to patch them all if this is the stance we are taking.

I agree that the modern spyware infesting our operating systems is also a significant concern. I disagree that having more than one problem to deal with is a good argument for not trying to solve the one at hand.

Do you guys turn JS off completely while surfing the net because you don't like someone analyzing your uses? It's hard to imagine what your comfortable life would look like.

For the same reason offbrand Firefox builds are called things like Icecat. Mozilla/Microsoft make the code available as open source, but that doesn't include a license to use the official name/logo or the company's brand. So if you roll and distribute a build without their authorization, you have to call it something else.

I’m sure Microsoft would hate any tweaked version hosted by third-party developers to use their branding (even if the only change is tweaking a few configuration variables by default)

Reply on news.ycombinator.com