5 ms·

Is there any technical evidence that Microsoft is doing something suspicious with the binaries? Differing hashes? Weird network traffic? Binary de-compilation?

by 013a 8y ago

Is there any technical evidence that Microsoft is doing something suspicious with the binaries? Differing hashes? Weird network traffic? Binary de-compilation? Its not hard to find evidence if you've got a hunch, instead of publishing a fear piece like this.

sebazzz 8y ago
It is a fear piece, but the premise that the binary is not MIT-licensed is true. This is the same for the dotNET core binaries, they don't have the same license as the source either. Now I think of it, this probably applies to most open-source libraries including ASP.NET MVC. Perhaps because they use hardware-based signing of the binary?
- simion314 8y ago
  >It is a fear piece, Why, you are even forbidden to reverse engineer or hack the binary so it is the total opposite of free software. Any idea why would they put this limitations on the binaries? What does MS gains for this ?
  - deleted 8y ago
    [deleted]
  - ohthehugemanate 8y ago
    What it gains is the ability to include some proprietary bits, including their branding, the extension system, and the option to send telemetry back. Just the same reason that the chrome binary isn't open source. Though MS doesn't make it's money on personal information, so the telemetry part is much more restricted.
    - TheForumTroll 8y ago
      >telemetry part is much more restricted Are you saying that Microsoft is collecting less information than Google would in the same situation? I find that very hard to believe looking at Microsoft's history. Do you have anything to back it up? The only comparison I can come up with is Windows 10 versus ChromeOS.
      - ohthehugemanate 8y ago
        Here's google's quarterly 10-Q statement.[1] "We generate revenues primarily by delivering relevant, cost-effective online advertising." For the quarter ending June 2018, google advertising revenues were $28,087 million, out of $32,657 million total. That's 86% of their total revenue, for those keeping score at home. Here's the relevant section of Microsoft's financial statement for the same time period. Advertising revenue is $6,100 million, out of $36,400 million. That's 17%. Microsoft doesn't even include the figure as a sub-line item, because their money makers are Azure and Office 365. I understand that MS has a history of being the great opponent to software freedom. I understand that they've made moves that are anti-developer, and anti-customer in some ways. But their business model has never been based on collecting information. It was based on selling licenses, and now it's based on paid PaaS and SaaS. With that in mind: it's hard to compare giant, decades-old corporations like this. We will inevitably come up with an incomplete list of anti-privacy things that both have done. But the profit motive lines up pretty clearly here. But because I can't resist... google privacy issues have a wikipedia page: https://en.wikipedia.org/wiki/Privacy_concerns_regarding_Google https://en.wikipedia.org/wiki/Privacy_concerns_regarding_Goo... . There is no analogous page about Microsoft privacy issues. [1] https://www.sec.gov/Archives/edgar/data/1652044/000165204418000027/goog10-qq22018.htm https://www.sec.gov/Archives/edgar/data/1652044/000165204418... [2] https://www.microsoft.com/en-us/Investor/earnings/FY-2018-Q4/more-personal-computing-performance https://www.microsoft.com/en-us/Investor/earnings/FY-2018-Q4...
jakobegger 8y ago
The license forbids you to reverse-engineer, so how would you find out without breaking the license?
- flukus 8y ago
  You can download the .deb/.rpm without accepting the license.
- mort96 8y ago
  Come on, nobody is preventing anyone from running the binary with strace or with wireshark open and comparing it to a version compiled from their sources. It's absolutely something which would've been relevant in a post like this one.
  - gnu8 8y ago
    None of that would fall under ‘reverse engineering’ in this context since those techniques are basic due diligence that would be required before running software from a disreputable source like Microsoft.
- carlchenet 8y ago
  I strongly agree, as I said in the article by license using VSC your renounce your rights to reverse-engineer the VSC. So you take a legal risk making it and blogging/talking/podcasting about it on Internet and can face legal actions.
  - kirb 8y ago
    I’m certain the community would be very surprised if Nadella’s “OSS is good” Microsoft tried to go after an independent research post citing that clause. It’s there so they have some legally valid substance to roll with if they want to go after a significant case. Say, Jetbrains implementing something that blatantly seems to have been inspired by reverse engineering a proprietary part of VSCode. Not a good example and VSCode’s proprietary bits are so minor it probably isn’t worth pursuing but it should highlight the difference. Keep in mind too it could gain more proprietary features in future, added without needing to update the EULA and bothering users with Yet Another Policy Update they have to agree to.
IloveHN84 8y ago
Telemetry is added in the Microsoft code for sure, plus some suggestions to Microsoft extensions.