3 ms·

Never trust a binary more than you trust the person who built it and the channel you downloaded it through. A better method might be to fork VSCode’s repo and

Never trust a binary more than you trust the person who built it and the channel you downloaded it through. A better method might be to fork VSCode’s repo and modify the build scripts and/or code to remove telemetry.

hsribei 8y ago
The repo has the scripts that are used to compile the binaries. It's not even a fork, it just downloads the code directly from the official repo.
floatingatoll 8y ago
Gentoo’s biggest failure to me is in persuading people that building from source is somehow safer than binaries. Never trust a source code repository more than you trust the people who commit it and the channel you downloaded it through. Autoupdates from a source repository that you don’t review before accepting updates are no safer than autoupdates from a binary source.
- craftyguy 8y ago
  > Gentoo’s biggest failure to me is in persuading people that building from source is somehow safer than binaries. I don't think this is a big reason Gentoo users use Gentoo. At least not the knowledgeable ones.
  - Zancarius 8y ago
    > I don't think this is a big reason Gentoo users use Gentoo. Exactly. The two most compelling reasons to use Gentoo are/were: 1) It's a rolling-release distribution and 2) it offers customization by virtue of building from source. I don't think I've seen the argument that it's more secure--not seriously anyway. I used it back then because I wasn't a huge fan of Linux and Gentoo seemed more familiar to me with its ports analog. Perhaps part of the OP's confusion is the hardened profile (or similar)? I'm not sure considering their wiki currently advertises it as risk mitigation [1], but I haven't used Gentoo in probably 6-7 years (at least not consistently outside a VM) so my memory on this is likely wrong. [1] https://wiki.gentoo.org/wiki/Hardened_Gentoo https://wiki.gentoo.org/wiki/Hardened_Gentoo
    - floatingatoll 8y ago
      To clarify: Gentoo did no harm. Many Gentoo users cited the risks of prebuilt binaries in their evangelism of Gentoo. That perceived risk remains an undercurrent in people’s thinking today, even though we’ve generally since realized that prebuilt binaries aren’t the risk we were led to believe they were back then. I blame the Gentoo evangelists of yesterdecade for this persistent “anti-binary” mindset, not Gentoo itself.

hsribei 8y ago

The repo has the scripts that are used to compile the binaries. It's not even a fork, it just downloads the code directly from the official repo.

floatingatoll 8y ago

Gentoo’s biggest failure to me is in persuading people that building from source is somehow safer than binaries. Never trust a source code repository more than you trust the people who commit it and the channel you downloaded it through. Autoupdates from a source repository that you don’t review before accepting updates are no safer than autoupdates from a binary source.

craftyguy 8y ago
> Gentoo’s biggest failure to me is in persuading people that building from source is somehow safer than binaries. I don't think this is a big reason Gentoo users use Gentoo. At least not the knowledgeable ones.
- Zancarius 8y ago
  > I don't think this is a big reason Gentoo users use Gentoo. Exactly. The two most compelling reasons to use Gentoo are/were: 1) It's a rolling-release distribution and 2) it offers customization by virtue of building from source. I don't think I've seen the argument that it's more secure--not seriously anyway. I used it back then because I wasn't a huge fan of Linux and Gentoo seemed more familiar to me with its ports analog. Perhaps part of the OP's confusion is the hardened profile (or similar)? I'm not sure considering their wiki currently advertises it as risk mitigation [1], but I haven't used Gentoo in probably 6-7 years (at least not consistently outside a VM) so my memory on this is likely wrong. [1] https://wiki.gentoo.org/wiki/Hardened_Gentoo https://wiki.gentoo.org/wiki/Hardened_Gentoo
  - floatingatoll 8y ago
    To clarify: Gentoo did no harm. Many Gentoo users cited the risks of prebuilt binaries in their evangelism of Gentoo. That perceived risk remains an undercurrent in people’s thinking today, even though we’ve generally since realized that prebuilt binaries aren’t the risk we were led to believe they were back then. I blame the Gentoo evangelists of yesterdecade for this persistent “anti-binary” mindset, not Gentoo itself.