Raspberry Pi phoning home to Microsoft | Hacker News Reader

Raspberry Pi phoning home to Microsoft

m.slashdot.org

30 pointsgonational10 comments

Any os doing cron based apt updates has been pinging people since... forever. Pkg update is no different. How do you know who hosts the mirror? Microsoft could have been getting this feed for a long time simply by backing one of the existing feed sources with a free mirror.

All that's changed is that they now get it for having invested in WSL and vscode, under their own name.

Running a free mirror would get them some of the hits, not all.

Sampling vs counting. But, I get your point.

"... This means Microsoft has access to every updated Pi computer running Raspberry Pi OS with rights to install any package, run any program, or edit any file without prompting the user. A lesser issue that has bothered some users is that on every run of apt update, the Raspbery Pi will send a request to packages.microsoft.com and thereby reveals the IP address for potential use in tracking or marketing efforts. "

https://en.wikipedia.org/wiki/Raspberry_Pi_OS#Microsoft_Repo...

It looks like someone ripped-out the section you're referencing.

Here's a link to a previous version of the linked Wiki article:

https://en.wikipedia.org/w/index.php?title=Raspberry_Pi_OS&d...

I don't understand the claim in the first sentence, and I don't understand how the linked thread supports it.

Any APT repo can push any package, e.g. this repo can give you a backdoored bash package

Sometimes repositories have duplicated packages, I'd be surprised if packages in earlier named repos didn't have precedence over later named repos. Meaning Microsoft couldn't just replace bash.

What an infuriatingly callous and altogether bad response from Eben Upton on Twitter....

https://mobile.twitter.com/EbenUpton/status/1357058711873871...

And that's before you even get to Microsoft owning ThreadX, the RTOS that runs on the pi before the main OS, and continues to run after boot.

Reply on news.ycombinator.com