8 ms·

Is this needed? You can disable telemetry from the settings: https://code.visualstudio.com/docs/supporting/FAQ#_how-to-disable-telemetry-reporting https://code.

Is this needed? You can disable telemetry from the settings: https://code.visualstudio.com/docs/supporting/FAQ#_how-to-disable-telemetry-reporting https://code.visualstudio.com/docs/supporting/FAQ#_how-to-di...

jeanlucas 8y ago
And it's possible to opt out on install... It's not like hidden or anything
- btgeekboy 8y ago
  You got an installer with yours?!
  - windexh8er 8y ago
    They're probably using Windows.
    - TimTheTinker 8y ago
      It’s easy to forget just how many things require an installer-wizard-type process on Windows after being on macOS and Linux for a few years.
      - naikrovek 8y ago
        Very few things, if any, REQUIRE an installer on Windows; it's just common (and annoying) that most software is distributed this way for that platform.
        orbifold 8y ago
        I for one prefer that the developer of an application takes responsibility for its installation. That way you can blame them if it does not work. On Linux distros many packages are close to uselesss because they are outdated or have been modified in weird ways incompatible with tutorials and documentation. This is especially true for all scientific software.
        snazz 8y ago
        I prefer that all my software is installed and updated in one fell swoop, with one single package manager, instead of requiring myriad installers, uninstallers, and update daemons that run in the background for practically each and every program, just sitting there wasting CPU cycles. If you dislike outdated software, try switching to a Testing or Unstable version of your operating system, or choosing a distro that packages less conservatively (Arch or Fedora, for instance).
        orbifold 8y ago
        Distribution maintained packages are a really bad idea. You start to realize this once you are not in control of the box you are working on (have no root access). Suddenly you are faced with CentOS 6.5 because some proprietary piece of software depends on a specific gcc version / libc version. Or you can't upgrade the cluster easily because parts of the legacy code depends on specific package versions (boost, gcc). So people invent Spack and before that modules just so that they don't have to depend on the specific package versions they are stuck with. macOS and windows got it right, just distribute all dependencies that you need and don't make any assumptions on the underlying system. Everything else sucks and Linux is a prime example of that. In short: Once you've worked with a large enough number of nighmarish Linux installations, you treat them as adversarial systems and wish you could install software just by clicking through a few screens.
        _nalply 8y ago
        I understand that you feel powerless and miss your own home PC where you are free to do what you like. However, the same could be true for software where you install by clicking if someone locked it so that you don't have administrator access and then neglected the system.
      - omaranto 8y ago
        I don't know about macOS, but doesn't most software on Linux require installation? I think the most common ways to distribute software are (1) as a package for your distribution's package manager (which the package manager installs, typically requiring superuser privileges), (2) as source code that you make & install, (3) as prebuilt binaries that you are meant to unpack and install. "Unpack and run from where they are" binaries do of course exist but aren't they less common than those 3 other types?
        snazz 8y ago
        Installation yes; installer no. To install VSCode on Debian, you would add the apt repository to your apt configuration, run apt update && apt upgrade, then apt install ______. On Windows, most software comes in the form of an installer instead of being installed with a system package manager. The difference is whether you have to click through one of those wizard things to get the program you want.
        deleted 8y ago
        [deleted]
bigmit37 8y ago
Thanks. I didn’t know that you can disable it.
fartcannon 8y ago
How much data does it send before giving you the opportunity to opt-out? I'm assuming a lot more than any privacy respecting application sends. If they were serious, it would be opt in.
false-mirror 8y ago
1. One less setting to configure, lest the Default monsters gets you 2. VSCodium is just a FLOSS VSCode binary. You could build it yourself from the available VSCode source. However, the VSCode binary is not FLOSS so you cannot be sure what it is running. It's not like VS code is the next PRISM-- I'm sure MS has better ways to spy on users ;). The real pull is whether you prefer FLOSS by default.
- cortesoft 8y ago
  How do we know the build of VSCodium is what they say it is? Aren't we in the exact same situation as with using the MS version, except we know even LESS about the maintainers?
- wongarsu 8y ago
  > However, the VSCode binary is not FLOSS so you cannot be sure what it is running. That's equally true of the VSCodium binary. It's not a reproducible build, I have no way of knowing from which source code the binary was generated. Of course I could build from source, but VSCodium is just VSCode built from source with a build flag set. So in this regard it's not contributing anything notable (and doesn't claim so either).
  - xyproto 8y ago
    Why is it not possible to build VSCodium in a reproducible way? Does it download packages while building?
    - O_H_E 8y ago
      I think this kind of reproducible: * https://reproducible-builds.org https://reproducible-builds.org * https://en.wikipedia.org/wiki/Reproducible_builds https://en.wikipedia.org/wiki/Reproducible_builds Sorry, but I don't think I am qualified to explain clearly
- h1d 8y ago
  It's kind of funny because now you're trusting some third party not to inject unwanted code when you just blindly download binary on every release anyway. Seems to just bring another problem by trying to solve one.
Crontab 8y ago
Yes it is - tracking that you have to opt-out of is evil (regardless of how well intentioned the tracking is).
- mips_avatar 8y ago
  But how do the PMs at Microsoft figure out new features without user data?
  - 0xffff2 8y ago
    How did anyone write software for decades before everything was connected to the internet?
    - Bjartr 8y ago
      Less effectively and at greater expense (with regards to understanding how large swathes of your userbase use your software in practice)
      - nitrogen 8y ago
        The lack of detailed usage monitoring resulted in more useful software that didn't cater to the lowest common denominator. Telemetry lets you shed all the baggage of supporting the minority.
        asutekku 8y ago
        That’s a bold claim. If the tool is made more useful for majority of the people using it is necessarily not a bad thing.
        eecc 8y ago
        Well there’s this thing in statistics called “seasonality”... I guess it manifesta very strongly in the JavaScript community given its propensity for framework fads (LOL) ...
Proven 8y ago
The idea is just silly. A Firefox without telemetry or tracking, yes. I visit political news sites and whatnot, so I don't want to be profiled. VSCode... oh, look I created Hello World in Python, that should stay a closely guarded secret! Or maybe not considering that I totally don't care if that info were public, let alone aggregated.
paavoova 8y ago
This has been an issue in the past: https://github.com/Microsoft/vscode/issues/16131 https://github.com/Microsoft/vscode/issues/16131 Telemetry not being disabled I have disabled telemetry as described in the FAQ. I have set the following properties in the settings: [..] Now despite of this, when I log my network traffic (with Wireshark) I can see that Visual Studio Code periodically contacts vortex.data.microsoft.com. For the record, Even with: [..] I still see connection attempts by Visual Studio Code to marketplace.visualstudio.com and vortex.data.microsoft.com at startup. Response is: I'm pretty sure we [VS Code Core] are doing the right thing here and we would love any pointers (all code is OSS). Which almost sounds like a complete deflection of the issue. The ticket was locked.
- specialist 8y ago
  This comment states that's the auto updater endpoint, not telemetry. https://github.com/Microsoft/vscode/issues/16131#issuecomment-312335570 https://github.com/Microsoft/vscode/issues/16131#issuecommen... Though there's no explanation for why VS Code continues to ping vortex.d.m.c even after updating is disabled. Hmmm.
  - paavoova 8y ago
    That comment is replying to another post by bsr203, not the OP.
- eridius 8y ago
  I just read through that issue, I see nothing wrong with the responses. First was an acknowledgement that when opted out they were still sending an unnecessary "user opted out" telemetry event and that it would be removed. Then indicating that subsequent network connections were for update checking, and extension update checking, and finally an explanation that while they can disable telemetry in the app, they can't control any telemetry that extensions may be doing, and promised that they're working hard to ensure any extensions created by their team and other teams in general do the right thing, but as they don't control that code there's not a whole lot they can do. I suppose it's not clear why vortex.data.microsoft.com is still on the list of servers being contacted at this point, but it seems quite plausible that this is coming from an extension.
rpdillon 8y ago
According to their docs, even VSCodium doesn't get all the telemetry out. https://github.com/VSCodium/vscodium/blob/master/DOCS.md#disable-telemetry https://github.com/VSCodium/vscodium/blob/master/DOCS.md#dis...
kumarvvr 8y ago
They know it. They just don't trust Microsoft.
- writepub 8y ago
  That's mighty dissonant and hypocritical of them to use and benefit from Microsoft's work and investment, and claim that their telemetry is the part they don't trust.
  - smadurange 8y ago
    Haha indeed. Besides, this is opensource and one can build it from source anytime. Using emotionally charged language to sell a trivial product.
  - prepend 8y ago
    VSCode is OSS right? So microsoft’s Work and Investment was specifically designed to be reused without any direct financial compensation. I don’t quite understand your point. Do you think that it’s hypocrtical to use and benefit from OSS work and investment? It seems important to respect the creator’s intent and if software is released under an OSS license it’s not dissonant or hypocritical or bad to reuse, or even make money under many licenses. It’s a feature, not a bug. In the 90s there used to be these companies that sold “internet in a box” in waldenbooks and other stores in the US. It was about $70 but it was all just OSS stuff- trumpet winsock, Eudora, mosaic, etc. I thought it was really crazy because it’s all available for free. One day I was in line behind an old guy who was buying it and he was so happy because it was conveniently packaging everything together and he had no idea how to bootstrap all these tools onto his PC. OSS is designed to allow this.
    - writepub 8y ago
      This is a clear case of people exploiting and perpetrating FUD (fear, uncertainty and doubt), riding on Microsoft's historic reputation as not being trustworthy, and turning it to their private benefit. If you have trust issues with Microsoft, you shouldn't be using software authored by them, as software can have backdoors and security issues hiding in plain sight (heart bleed bug, for instance). Atom has/had the exact same kind of telemetry, but hasn't attracted this type of hysteria, because GitHub wasn't Microsoft. This is all plain and simple dogma.
paulcarroty 8y ago
It doesn't works, you can search the proof in vscodium issues(keyword: little snitch). It's the main reason why regex are used in CI pipelines to clean MS code from telemetry servers.
Memosyne 8y ago
VSCode initializes the module they use to collect telemetry (Application Insights / A.I.) even if you disable that setting [1]. 1. https://github.com/Microsoft/vscode/issues/63404 https://github.com/Microsoft/vscode/issues/63404
- bpicolo 8y ago
  They explicitly created a tech debt issue to fix that, seem reasonable to me?
  - nojvek 7y ago
    Been open for 5 months though. Doesn’t look that privacy is high up on their priority list.
akerro 8y ago
Telemetry is reset to enabled on every update, don't forget to change every time.
- carlmr 8y ago
  Hasn't happened for me. No update has ever touched my user settings.
- trickstra 8y ago
  Not for me. I remember disabling it after first install, now I checked (panicking after reading your comment) and it's still disabled even after many updates in between. Ubuntu.

jeanlucas 8y ago

And it's possible to opt out on install... It's not like hidden or anything

btgeekboy 8y ago
You got an installer with yours?!
- windexh8er 8y ago
  They're probably using Windows.
  - TimTheTinker 8y ago
    It’s easy to forget just how many things require an installer-wizard-type process on Windows after being on macOS and Linux for a few years.
    - naikrovek 8y ago
      Very few things, if any, REQUIRE an installer on Windows; it's just common (and annoying) that most software is distributed this way for that platform.
      - orbifold 8y ago
        I for one prefer that the developer of an application takes responsibility for its installation. That way you can blame them if it does not work. On Linux distros many packages are close to uselesss because they are outdated or have been modified in weird ways incompatible with tutorials and documentation. This is especially true for all scientific software.
        snazz 8y ago
        I prefer that all my software is installed and updated in one fell swoop, with one single package manager, instead of requiring myriad installers, uninstallers, and update daemons that run in the background for practically each and every program, just sitting there wasting CPU cycles. If you dislike outdated software, try switching to a Testing or Unstable version of your operating system, or choosing a distro that packages less conservatively (Arch or Fedora, for instance).
        orbifold 8y ago
        Distribution maintained packages are a really bad idea. You start to realize this once you are not in control of the box you are working on (have no root access). Suddenly you are faced with CentOS 6.5 because some proprietary piece of software depends on a specific gcc version / libc version. Or you can't upgrade the cluster easily because parts of the legacy code depends on specific package versions (boost, gcc). So people invent Spack and before that modules just so that they don't have to depend on the specific package versions they are stuck with. macOS and windows got it right, just distribute all dependencies that you need and don't make any assumptions on the underlying system. Everything else sucks and Linux is a prime example of that. In short: Once you've worked with a large enough number of nighmarish Linux installations, you treat them as adversarial systems and wish you could install software just by clicking through a few screens.
        _nalply 8y ago
        I understand that you feel powerless and miss your own home PC where you are free to do what you like. However, the same could be true for software where you install by clicking if someone locked it so that you don't have administrator access and then neglected the system.
    - omaranto 8y ago
      I don't know about macOS, but doesn't most software on Linux require installation? I think the most common ways to distribute software are (1) as a package for your distribution's package manager (which the package manager installs, typically requiring superuser privileges), (2) as source code that you make & install, (3) as prebuilt binaries that you are meant to unpack and install. "Unpack and run from where they are" binaries do of course exist but aren't they less common than those 3 other types?
      - snazz 8y ago
        Installation yes; installer no. To install VSCode on Debian, you would add the apt repository to your apt configuration, run apt update && apt upgrade, then apt install ______. On Windows, most software comes in the form of an installer instead of being installed with a system package manager. The difference is whether you have to click through one of those wizard things to get the program you want.
        deleted 8y ago
        [deleted]

bigmit37 8y ago

Thanks. I didn’t know that you can disable it.

fartcannon 8y ago

How much data does it send before giving you the opportunity to opt-out? I'm assuming a lot more than any privacy respecting application sends. If they were serious, it would be opt in.

false-mirror 8y ago

1. One less setting to configure, lest the Default monsters gets you 2. VSCodium is just a FLOSS VSCode binary. You could build it yourself from the available VSCode source. However, the VSCode binary is not FLOSS so you cannot be sure what it is running. It's not like VS code is the next PRISM-- I'm sure MS has better ways to spy on users ;). The real pull is whether you prefer FLOSS by default.

cortesoft 8y ago
How do we know the build of VSCodium is what they say it is? Aren't we in the exact same situation as with using the MS version, except we know even LESS about the maintainers?
wongarsu 8y ago
> However, the VSCode binary is not FLOSS so you cannot be sure what it is running. That's equally true of the VSCodium binary. It's not a reproducible build, I have no way of knowing from which source code the binary was generated. Of course I could build from source, but VSCodium is just VSCode built from source with a build flag set. So in this regard it's not contributing anything notable (and doesn't claim so either).
- xyproto 8y ago
  Why is it not possible to build VSCodium in a reproducible way? Does it download packages while building?
  - O_H_E 8y ago
    I think this kind of reproducible: * https://reproducible-builds.org https://reproducible-builds.org * https://en.wikipedia.org/wiki/Reproducible_builds https://en.wikipedia.org/wiki/Reproducible_builds Sorry, but I don't think I am qualified to explain clearly
h1d 8y ago
It's kind of funny because now you're trusting some third party not to inject unwanted code when you just blindly download binary on every release anyway. Seems to just bring another problem by trying to solve one.

Crontab 8y ago

Yes it is - tracking that you have to opt-out of is evil (regardless of how well intentioned the tracking is).

mips_avatar 8y ago
But how do the PMs at Microsoft figure out new features without user data?
- 0xffff2 8y ago
  How did anyone write software for decades before everything was connected to the internet?
  - Bjartr 8y ago
    Less effectively and at greater expense (with regards to understanding how large swathes of your userbase use your software in practice)
    - nitrogen 8y ago
      The lack of detailed usage monitoring resulted in more useful software that didn't cater to the lowest common denominator. Telemetry lets you shed all the baggage of supporting the minority.
      - asutekku 8y ago
        That’s a bold claim. If the tool is made more useful for majority of the people using it is necessarily not a bad thing.
        eecc 8y ago
        Well there’s this thing in statistics called “seasonality”... I guess it manifesta very strongly in the JavaScript community given its propensity for framework fads (LOL) ...

Proven 8y ago

The idea is just silly. A Firefox without telemetry or tracking, yes. I visit political news sites and whatnot, so I don't want to be profiled. VSCode... oh, look I created Hello World in Python, that should stay a closely guarded secret! Or maybe not considering that I totally don't care if that info were public, let alone aggregated.

paavoova 8y ago

This has been an issue in the past: https://github.com/Microsoft/vscode/issues/16131 https://github.com/Microsoft/vscode/issues/16131 Telemetry not being disabled I have disabled telemetry as described in the FAQ. I have set the following properties in the settings: [..] Now despite of this, when I log my network traffic (with Wireshark) I can see that Visual Studio Code periodically contacts vortex.data.microsoft.com. For the record, Even with: [..] I still see connection attempts by Visual Studio Code to marketplace.visualstudio.com and vortex.data.microsoft.com at startup. Response is: I'm pretty sure we [VS Code Core] are doing the right thing here and we would love any pointers (all code is OSS). Which almost sounds like a complete deflection of the issue. The ticket was locked.

specialist 8y ago
This comment states that's the auto updater endpoint, not telemetry. https://github.com/Microsoft/vscode/issues/16131#issuecomment-312335570 https://github.com/Microsoft/vscode/issues/16131#issuecommen... Though there's no explanation for why VS Code continues to ping vortex.d.m.c even after updating is disabled. Hmmm.
- paavoova 8y ago
  That comment is replying to another post by bsr203, not the OP.
eridius 8y ago
I just read through that issue, I see nothing wrong with the responses. First was an acknowledgement that when opted out they were still sending an unnecessary "user opted out" telemetry event and that it would be removed. Then indicating that subsequent network connections were for update checking, and extension update checking, and finally an explanation that while they can disable telemetry in the app, they can't control any telemetry that extensions may be doing, and promised that they're working hard to ensure any extensions created by their team and other teams in general do the right thing, but as they don't control that code there's not a whole lot they can do. I suppose it's not clear why vortex.data.microsoft.com is still on the list of servers being contacted at this point, but it seems quite plausible that this is coming from an extension.

rpdillon 8y ago

According to their docs, even VSCodium doesn't get all the telemetry out. https://github.com/VSCodium/vscodium/blob/master/DOCS.md#disable-telemetry https://github.com/VSCodium/vscodium/blob/master/DOCS.md#dis...

kumarvvr 8y ago

They know it. They just don't trust Microsoft.

writepub 8y ago
That's mighty dissonant and hypocritical of them to use and benefit from Microsoft's work and investment, and claim that their telemetry is the part they don't trust.
- smadurange 8y ago
  Haha indeed. Besides, this is opensource and one can build it from source anytime. Using emotionally charged language to sell a trivial product.
- prepend 8y ago
  VSCode is OSS right? So microsoft’s Work and Investment was specifically designed to be reused without any direct financial compensation. I don’t quite understand your point. Do you think that it’s hypocrtical to use and benefit from OSS work and investment? It seems important to respect the creator’s intent and if software is released under an OSS license it’s not dissonant or hypocritical or bad to reuse, or even make money under many licenses. It’s a feature, not a bug. In the 90s there used to be these companies that sold “internet in a box” in waldenbooks and other stores in the US. It was about $70 but it was all just OSS stuff- trumpet winsock, Eudora, mosaic, etc. I thought it was really crazy because it’s all available for free. One day I was in line behind an old guy who was buying it and he was so happy because it was conveniently packaging everything together and he had no idea how to bootstrap all these tools onto his PC. OSS is designed to allow this.
  - writepub 8y ago
    This is a clear case of people exploiting and perpetrating FUD (fear, uncertainty and doubt), riding on Microsoft's historic reputation as not being trustworthy, and turning it to their private benefit. If you have trust issues with Microsoft, you shouldn't be using software authored by them, as software can have backdoors and security issues hiding in plain sight (heart bleed bug, for instance). Atom has/had the exact same kind of telemetry, but hasn't attracted this type of hysteria, because GitHub wasn't Microsoft. This is all plain and simple dogma.

paulcarroty 8y ago

It doesn't works, you can search the proof in vscodium issues(keyword: little snitch). It's the main reason why regex are used in CI pipelines to clean MS code from telemetry servers.

Memosyne 8y ago

VSCode initializes the module they use to collect telemetry (Application Insights / A.I.) even if you disable that setting [1]. 1. https://github.com/Microsoft/vscode/issues/63404 https://github.com/Microsoft/vscode/issues/63404

bpicolo 8y ago
They explicitly created a tech debt issue to fix that, seem reasonable to me?
- nojvek 7y ago
  Been open for 5 months though. Doesn’t look that privacy is high up on their priority list.

akerro 8y ago

Telemetry is reset to enabled on every update, don't forget to change every time.

carlmr 8y ago
Hasn't happened for me. No update has ever touched my user settings.
trickstra 8y ago
Not for me. I remember disabling it after first install, now I checked (panicking after reading your comment) and it's still disabled even after many updates in between. Ubuntu.