3 ms·

If I needed a one-time “use it and lose it” attack vector, this would be an excellent way to provide one. Imagine how many thousands of code repositories I coul

If I needed a one-time “use it and lose it” attack vector, this would be an excellent way to provide one. Imagine how many thousands of code repositories I could _successfully_ inject a backdoor into, using only a repackaged “without the telemetry” version of Microsoft’s code. Y’all are far too trusting. Edit: The point is that we all have a blind spot around risk assessment and threat evaluation when it comes to certain software topics, such as code editors and terminal software.

TimTheTinker 8y ago
Never trust a binary more than you trust the person who built it and the channel you downloaded it through. A better method might be to fork VSCode’s repo and modify the build scripts and/or code to remove telemetry.
- hsribei 8y ago
  The repo has the scripts that are used to compile the binaries. It's not even a fork, it just downloads the code directly from the official repo.
- floatingatoll 8y ago
  Gentoo’s biggest failure to me is in persuading people that building from source is somehow safer than binaries. Never trust a source code repository more than you trust the people who commit it and the channel you downloaded it through. Autoupdates from a source repository that you don’t review before accepting updates are no safer than autoupdates from a binary source.
  - craftyguy 8y ago
    > Gentoo’s biggest failure to me is in persuading people that building from source is somehow safer than binaries. I don't think this is a big reason Gentoo users use Gentoo. At least not the knowledgeable ones.
    - Zancarius 8y ago
      > I don't think this is a big reason Gentoo users use Gentoo. Exactly. The two most compelling reasons to use Gentoo are/were: 1) It's a rolling-release distribution and 2) it offers customization by virtue of building from source. I don't think I've seen the argument that it's more secure--not seriously anyway. I used it back then because I wasn't a huge fan of Linux and Gentoo seemed more familiar to me with its ports analog. Perhaps part of the OP's confusion is the hardened profile (or similar)? I'm not sure considering their wiki currently advertises it as risk mitigation [1], but I haven't used Gentoo in probably 6-7 years (at least not consistently outside a VM) so my memory on this is likely wrong. [1] https://wiki.gentoo.org/wiki/Hardened_Gentoo https://wiki.gentoo.org/wiki/Hardened_Gentoo
      - floatingatoll 8y ago
        To clarify: Gentoo did no harm. Many Gentoo users cited the risks of prebuilt binaries in their evangelism of Gentoo. That perceived risk remains an undercurrent in people’s thinking today, even though we’ve generally since realized that prebuilt binaries aren’t the risk we were led to believe they were back then. I blame the Gentoo evangelists of yesterdecade for this persistent “anti-binary” mindset, not Gentoo itself.
fredch 8y ago
Shameful FUD
OnlyRepliesToBS 8y ago
lol ironic as fuck
deleted 8y ago
[deleted]

TimTheTinker 8y ago

Never trust a binary more than you trust the person who built it and the channel you downloaded it through. A better method might be to fork VSCode’s repo and modify the build scripts and/or code to remove telemetry.

hsribei 8y ago
The repo has the scripts that are used to compile the binaries. It's not even a fork, it just downloads the code directly from the official repo.
floatingatoll 8y ago
Gentoo’s biggest failure to me is in persuading people that building from source is somehow safer than binaries. Never trust a source code repository more than you trust the people who commit it and the channel you downloaded it through. Autoupdates from a source repository that you don’t review before accepting updates are no safer than autoupdates from a binary source.
- craftyguy 8y ago
  > Gentoo’s biggest failure to me is in persuading people that building from source is somehow safer than binaries. I don't think this is a big reason Gentoo users use Gentoo. At least not the knowledgeable ones.
  - Zancarius 8y ago
    > I don't think this is a big reason Gentoo users use Gentoo. Exactly. The two most compelling reasons to use Gentoo are/were: 1) It's a rolling-release distribution and 2) it offers customization by virtue of building from source. I don't think I've seen the argument that it's more secure--not seriously anyway. I used it back then because I wasn't a huge fan of Linux and Gentoo seemed more familiar to me with its ports analog. Perhaps part of the OP's confusion is the hardened profile (or similar)? I'm not sure considering their wiki currently advertises it as risk mitigation [1], but I haven't used Gentoo in probably 6-7 years (at least not consistently outside a VM) so my memory on this is likely wrong. [1] https://wiki.gentoo.org/wiki/Hardened_Gentoo https://wiki.gentoo.org/wiki/Hardened_Gentoo
    - floatingatoll 8y ago
      To clarify: Gentoo did no harm. Many Gentoo users cited the risks of prebuilt binaries in their evangelism of Gentoo. That perceived risk remains an undercurrent in people’s thinking today, even though we’ve generally since realized that prebuilt binaries aren’t the risk we were led to believe they were back then. I blame the Gentoo evangelists of yesterdecade for this persistent “anti-binary” mindset, not Gentoo itself.

fredch 8y ago

Shameful FUD

OnlyRepliesToBS 8y ago

lol ironic as fuck

deleted 8y ago

[deleted]