10 ms·
VSCode silently opts you in to data collection
- tmkbry 8y agohttps://imgur.com/a/wii2zVT https://imgur.com/a/wii2zVT is what everybody gets when starting VSCode for the first time.
- samuelg123 8y agoI’d argue this isn’t enough. They should explicitly ask, especially when you’re using the application to handle sensitive material such as unreleased code.
- rhizome 8y agoIt's user-hostile, business-unfriendly, and completely intentional.
- alkonaut 8y agoI agree the yes/no should be the question (always) and not any extra work to opt out. That said, if usage data is the goal, then any personal info or content you work on being uploaded would be a critical bug, a bug of the kind that could just as (un)likely appear in any other part of the software regardless of whether telemetry is on. E.g the request to fetch extension listings could accidentally contain your info, or the git code could post your stuff suppose to go to a private repo to a public one through a bug. I really don’t see why sensitive or personal info would be at risk with telemetry (of the acceptable kind ie feature use stats). If that is compromised by telemetry then it’s either a) a bug (see above) or b) they are deliberately being malware. And in that case - why even ask?
- WalterGR 8y agoThey should explicitly ask, especially when you’re using the application to handle sensitive material such as unreleased code. Do you think that VSCode’s telemetry uploads your code to Microsoft?
- morpheuskafka 8y agoIf you have trade secrets, it is incumbent on you to appropriately review the privacy policies and settings of tools before you run them on a machine with sensitive info.
- DannyBee 8y agoExcept even if that was enough, people upgrading were just auto-opted back in (AFAICT). It definitely happened to me!
- cwyers 8y agoYes. The title is against site guidelines ("Otherwise please use the original title, unless it is misleading or linkbait; don't editorialize.") and it's incorrect; there's nothing silent about it.
- alangibson 8y agoThe title is clearly correct. When you get that message, you have already been silently opted in. You must then to read the instructions and opt yourself out.
- tapirl 8y agoI disabled the telemetry feature before, but the latest vsc version reverts it to enabled automatically, holy creepy. And the latest version introduces many other data collection ways. Search them in settings with the keyword "online", you will find them all. Don't know whether or not there are other hidden ways which are not shown in the setting page.
- nathantotten 8y agoI’d file a bug. This is almost certainly not intentional.
- blibble 8y agoyeah just like for every large Windows update your default browser accidentally gets reset to MS Edge totally a bug
- KyeRussell 8y agoMicrosoft is a very big company and I have absolutely no doubt that the Windows team and the VSCode team hardly ever—if at all—talk. I also question how 'evil' policies like this could propagate across company divisions to the point where they are actually implemented in code—in today's age where engineers have a lot of agency over what they do and often speak up—without someone leaking said policy. This is just a conspiracy theory.
- bostik 8y agoOr perhaps a result of tying team bonuses and promotions to "increased coverage", whatever that means for each product. Not necessarily malicious - just myopic.
- delfinom 8y agoYeah, they've done alot of work recently adding an entire settings UI so it may have broke in that change.
- 8y ago
- type0 8y agoAny reason why Microsofts own extensions are not able use the global settings disabling telemetry? https://github.com/Microsoft/vscode-docs-authoring/blob/master/docs-markdown/src/telemetry/telemetry.ts https://github.com/Microsoft/vscode-docs-authoring/blob/mast...
- CamperBob2 8y agoBecause then they don't get to hoover up as much of your data.
- ayyyyylmao2000 8y agoSorry to see your downvote. Techno-communists on the prowl.
- nathantotten 8y agoThe package they are using “vscode-extension-telemetry” actually does use the global setting. https://github.com/Microsoft/vscode-extension-telemetry/blob/master/src/telemetryReporter.ts https://github.com/Microsoft/vscode-extension-telemetry/blob... Third-party extensions can read that setting too so they can respect the global choice.
- userbinator 8y agoUnless it's otherwise known, I think it's safe to assume that every not-tiny application contains phone-home spyware these days. It's not long ago when that wasn't the case, and many users had application firewalls that would alert (and block by default) such attempts. I'd say Win10 was probably the "breaking point" for such behaviour being normalised. I'm one of those (probably tiny minority) who inspect the binaries of closed-source applications before using them, and will reject those containing networking-related functionality if the application should have no reason to do so.
- yjftsjthsd-h 8y agoWhat kind of inspection do you do? I assume something more involved than strings(1)?
- userbinator 8y agoOpening it in a hex editor is one of the things I do, yes. I also inspect imports too. If the code is obfuscated, that's another reason for rejection.
- craftyguy 8y agoEmacs doesn't try to 'phone home' and it's the very definition of a 'not-tiny' app. Neither does (neo)vim.
- randallsquared 8y agoIt’s the very definition of a ‘not-tiny’ app from 1995... In the context of Electron apps, no emacs is in the running.
- paglia_s 8y agoHas everyone already forgotten about GDPR?
- ygra 8y agoIs this personally identifiable information? If not, then the GDPR has nothing to do with it.
- _trampeltier 8y agoHaving names besides the bell in a apartment building is forbidden. GDPR is fun ... https://wien.orf.at/news/stories/2941086/ https://wien.orf.at/news/stories/2941086/
- mschuetz 8y agoRead the article before spouting nonsense. You're free to attach your name to the bell if you want for whatever reason. Only landlords are now not allowed to attach your name to the doorbell by default in Austria, and apparently they weren't allowed to do so since 1980 but it's only being enforced now.
- c487bd62 8y ago> Stop using sha256(MAC address) for telemetry machine ID #8688 https://github.com/Microsoft/vscode/issues/8688 https://github.com/Microsoft/vscode/issues/8688
- sam0x17 8y agoThis is why it is a great idea to use VSCodium. An open source fork of VSCode that removes telemetry and packages itself for all major operating systems. https://github.com/VSCodium/vscodium https://github.com/VSCodium/vscodium
- theprotocol 8y agoI had no idea this existed. Thanks!
- russdpale 8y agoHoly moly true pro tip. Thanks good person!!!
- smartbit 8y agoAfter installing VSCodium, you must manually disable telemetry in your settings file to stop it from sending tracking data to Microsoft. https://github.com/VSCodium/vscodium#getting-all-the-telemetry-out https://github.com/VSCodium/vscodium#getting-all-the-telemet...
- macns 8y agoEven though we do not pass the telemetry build flags (and go out of our way to cripple the baked-in telemetry), Microsoft will still track usage by default. After installing VSCodium, you must manually disable telemetry in your settings file to stop it from sending tracking data to Microsoft. The instructions here and here help with disabling telemetry.
- kardos 8y agoGood first issue for a new contributor?
- userbinator 8y agoThat makes me wonder why they didn't just go all the way? Was there "advice" from MS to not do so?
- vgy7ujm 8y agoVim anyone?
- deleted 8y ago[deleted]
- krn 8y agoHow is VSCode different from Firefox? Both have telemetry enabled by default, and both allow to opt out of it[1]. [1] https://www.mozilla.org/en-US/privacy/firefox/ https://www.mozilla.org/en-US/privacy/firefox/
- Laaas 8y agoI don't see why Firefox is relevant? It's still a shame that they are both like that though.
- giancarlostoro 8y agoTwo products that opt you into telemetry collection, how is it not relevant? Every time I install anything I check through all the preferences / settings options and opt out of any of these things. There's been few cases where I just leave it all on.
- WalterGR 8y agoHow is VSCode different from Firefox? Both have telemetry enabled by default Yep. So does Google Chrome, Apple macOS, Apple iOS, Canonical Ubuntu, and an uncountable number of programs, apps, and websites. But VSCode is a Microsoft product, so it gives us an opportunity to do some serious pearl clutching and collectively lose our shit.
- alangibson 8y agoThe issue isn't that it's MS. The issue is that it is opt-out, not opt-in. Has nothing to do with who's pulling the shenanigans.
- Buge 8y agoFirefox is also opt-out.
- NeedMoreTea 8y ago
- electic 8y agoI guess this might be a precursor to the type of behavior we can expect to see with the GitHub acquisition. Secondly, is there anyone out there that has a solid emacs step by step guide that might be able to replicate the functionality of vscode? I haven't had time to look at it but I think the time has come where I can't put it off any longer.
- brett40324 8y agoWhen I first installed vscode, I assumed this was the case and yep, there it was buried in preferences. Disable all of it, including automatic updates. When you want to update, uninstall and install again fresh. Then disable again. Repeat.
- nathantotten 8y agoI know a lot of people don’t like things like this, but also remember not all data collection is malicious. If you look at what they actually collect it’s not pulling a bunch of personal info. They collect usage, perf and errors. As a product manager (not for vsc or MS) I use this type of telemetry all the time to make priorization decisions. It’s a balance, but my hunch is the team at MS uses this info exclusively to make the product better. Of course, you should always be able to disable this sort of collection.
- TheAceOfHearts 8y agoNo, you should ALWAYS explicitly ask for user consent. You should explain exactly what kind of data is being collected and how it's used and ask them if they are fine with that. Anything else is unethical. I'll happily enable certain kinds of data collection when a tool is transparent and it makes its data collection opt-in.
- arghwhat 8y agoI'm a privacy advocate, but I'm 100% okay with on-by-default error collection, as long as the logging is scrubbed of personal data. Usage analysis is different, and should be opt-in.
- mrob 8y agoEven if we accept that scrubbing of personal data is possible, which is far from certain, that theoretically non-malicious traffic still provides camouflage for malicious traffic. If we insist on opt-in, then we can apply a very simple and fail-safe heuristic: any traffic the user didn't explicitly request is malicious. There's no need for slow and error-prone analysis.
- arghwhat 8y agoAnd how in the world do you intend to distinguish traffic? How do you intend to tell the difference between Atom's and VSCode's Git(hub) integration, app updater, package manager, telemetrics or an exploitation? The difference between a Signal, WhatsApp or Telegrams' messages and their telemetrics? Your proposed heuristic only works for applications that would not otherwise have any network traffic, and even then, only if you do on-machine per-process network monitoring. Once it has any valid traffic what-so-ever (which is the case for basically any modern GUI application), then you quickly descend into needing to disassemble binaries locate the cause. Opt-in vs. opt-out is about privacy and rights, not about security. Malicious companies whose traffic are a security breach and things down those lines are problems that belong in an entirely different discussion, whose root-cause is much deeper than opt-in vs. opt-out. Also, regarding scrubbing: A stack-trace and error message is far from private identifying information. No harm done in sharing it.
- rubiquity 8y agoWhen Microsoft bought GitHub I didn’t think about GitHub Enterprise revenue. I thought about all of the language package managers that use GitHub’s APIs for downloading repos.
- algorithm_dk 8y agoNothing new here, VSCode had this for a long time. Also I don't find anything wrong with shipping software with data collection on by default.
- frogperson 8y agoIs there a plug-in that pops a big red warning when telemetry is turned on? That's woul be very useful.
- kgwxd 8y agoAt least they changed the code names, it used to be "telemetry.optIn = true", showing how little they understand the term opt-in.
- naikrovek 8y agoIf someone wants to try to explain to me why the collection of application telemetry is bad, that'd be great.
- alangibson 8y agoIt's not inherently bad. Collecting telemetry on an opt-out basis, as opposed to opt-in, is.
- anonlastname 8y agois this at all surprising given that we're talking about the company that made windows? did we forget that for a while it would silently put telemetry in your binaries?
- WalterGR 8y agoit would silently put telemetry in your binaries? What do you mean?
- anonlastname 8y agoFor a while VS code would do that but they claimed it was an accident. https://www.geeks3d.com/20160610/vs2015-how-to-remove-windows-telemetry-function-call-from-your-c-binaries/ https://www.geeks3d.com/20160610/vs2015-how-to-remove-window...
- xte 8y agoI have Emacs, why bother with other limited editors? Emacs can do what they do + far, far more so...
- purplezooey 8y ago... extensions may be collecting their own usage data and are not controlled by the telemetry.enableTelemetry... wtf. So it's like whack-a-mole.