17 ms·
VS Code without Microsoft branding/telemetry/licensing
- fgonzag 6y agoWhy would you remove the MS branding? Does it somehow hurt your privacy to acknowledge who the developer and sponsor is?
- tech_dreamer 6y agoI didn't post the original link. MS collects analytics - which I am not comfortable with. Capability matters and intentions can change later. :)
- packetslave 6y agoYou could always just set `telemetry.enableTelemetry` to false and continue to use the official builds.
- Silhouette 6y agoBut only if you trust Microsoft to honour that setting indefinitely, and not for example to just change it back later or hide something shady behind another option instead. At this point, a lot of people understandably don't.
- xeromal 6y agoIt's open source. You could see for yourself. lol
- Silhouette 6y agoSure, and then you could check again every time there is an update. But why bother, when there is already an uncontaminated version readily available to solve this problem for you?
- eknkc 6y agoHow do you know it is uncontaminated without looking at the source code?
- Silhouette 6y agoTechnically you don't, just like any other software, but the risk is surely significantly lower since everyone including Microsoft is saying that what Microsoft is doing is taking that same code and then adding its contaminants on top.
- deleted 6y ago[deleted]
- paulcarroty 6y agoVSC sends telemetry after first run, so there's no big sense to do it. Also you can't block telemetry by Windows firewall. P.S. Proud hoster of VSCodium Linux repo https://gitlab.com/paulcarroty/vscodium-deb-rpm-repo https://gitlab.com/paulcarroty/vscodium-deb-rpm-repo
- antigirl 6y agoThat can be true for almost all software then?
- Silhouette 6y agoSure, but almost all software is not produced by a giant corporation with a well-established track record of pushing user-hostile changes via updates, including overriding or reverting the user's explicitly chosen privacy settings, and including taking such actions in the recent past. Microsoft is not on your side when it comes to privacy and data security. It has made this abundantly clear both by its actions and by the statements of its senior leadership. However much anyone here might like VS Code, it is still a Microsoft product, while the alternative under discussion is not. I'm genuinely surprised so many people seem to be leaping to the defence of VS Code here. Why? It's the same application, just made worse by Microsoft's telemetry (and the accompanying infamously opaque privacy policies). Unless you need one of the extensions that is tied specifically to the official Microsoft version, why wouldn't you go with the safer option?
- antigirl 6y agoI'm not defending MS just curious. Safer option is not convinent by any means. The fork linked is also open to malicious behaviour. The maintainer can sneak in any code, issues we seen similar to npm. So if you feel this way about MS then you cant be on Windows. Apple have also been known to report users location secretley on iPhones. I'm on OSX and i dont entirely trust them either. Theres too many holes here, really have to patch them all if this is the stance we are taking.
- Silhouette 6y agoTheres too many holes here, really have to patch them all if this is the stance we are taking. I agree that the modern spyware infesting our operating systems is also a significant concern. I disagree that having more than one problem to deal with is a good argument for not trying to solve the one at hand.
- mekster 6y agoDo you guys turn JS off completely while surfing the net because you don't like someone analyzing your uses? It's hard to imagine what your comfortable life would look like.
- klyrs 6y ago> Why would you remove the MS branding? Barely-educated guess based on Debian / Mozilla stances on the matter: un-branding an OSS project can be necessary to avoid trademark infringement. edit re sibling comment: yup, the MIT licensed code provided by microsoft is apparently unbranded (i.e. it wasn't "removed"). This is almost certainly done for trademark protection.
- karatestomp 6y agoJust like IceWeasel on Debian. Can use the code, can't (necessarily) use the name.
- IvyMike 6y agoAnswered in the github repo itself: https://github.com/VSCodium/vscodium#why https://github.com/VSCodium/vscodium#why
- solidasparagus 6y agoThis link does not answer the question.
- deleted 6y ago[deleted]
- MaxLeiter 6y agoIt does but not very clearly. Therefore, you generate a 'clean' build, without the Microsoft customizations, which is by default licensed under the MIT license Microsoft customizations include their branding
- solidasparagus 6y agoThat doesn't answer 'why' at all.
- stan_rogers 6y agoYes, it does. The build cannot use the Microsoft branding.
- solidasparagus 6y ago> This repository contains build files to generate free release binaries of Microsoft's VSCode. When we speak of "free software", we're talking about freedom, not price. > Microsoft's downloads of Visual Studio Code are licensed under this not-FLOSS license and contain telemetry/tracking. According to this comment from a Visual Studio Code maintainer: > When we [Microsoft] build Visual Studio Code, we do exactly this. We clone the vscode repository, we lay down a customized product.json that has Microsoft specific functionality (telemetry, gallery, logo, etc.), and then produce a build that we release under our license. > When you clone and build from the vscode repo, none of these endpoints are configured in the default product.json. Therefore, you generate a "clean" build, without the Microsoft customizations, which is by default licensed under the MIT license > This repo exists so that you don't have to download+build from source. The build scripts in this repo clone Microsoft's vscode repo, run the build commands, and upload the resulting binaries to GitHub releases. These binaries are licensed under the MIT license. Telemetry is disabled. > If you want to build from source yourself, head over to Microsoft's vscode repo and follow their instructions. This repo exists to make it easier to get the latest version of MIT-licensed VSCode. > Microsoft's build process (which we are running to build the binaries) does download additional files. This was brought up in Microsoft/vscode#49159 and Microsoft/vscode#45978. These are the packages downloaded during build" That's the entire contents of the link. Which part of that do you think explains why they don't use Microsoft branding? > none of these endpoints are configured in the default product.json Literally all it says is that by default it doesn't use Microsoft branding. It never says 'why'. At all.
- ssivark 6y agoI’m sure Microsoft would hate any tweaked version hosted by third-party developers to use their branding (even if the only change is tweaking a few configuration variables by default)
- cbarrick 6y agoIt's not about removing the MS branding. MS does not allow their branding to be distributed in unofficial builds. So if you want a custom build of VS Code, you are required to swap out the branding.
- bitwize 6y agoFor the same reason offbrand Firefox builds are called things like Icecat. Mozilla/Microsoft make the code available as open source, but that doesn't include a license to use the official name/logo or the company's brand. So if you roll and distribute a build without their authorization, you have to call it something else.
- kgwxd 6y agoIt'd be really cool if all open source was just designed with this in mind by the original coders. branding/telemetry/licensing should be explicit compile-time parameters that, left unspecified, exclude it completely.
- Wowfunhappy 6y agoI think Firefox works like this with regard to branding, right? People were also saying in a HN thread about WinGet the other day that privately-compiled builds would not have telemetry.
- ipsum2 6y agoNo, Firefox has telemetry built in, its not stripped on compile time.
- Wowfunhappy 6y agoSorry, to be clear, for Firefox I was talking about branding.
- nojito 6y agoOpt out means devs get crappy data. Only way for software to improve is to get usage data. Would you rather be stuck with crappy software dictated by the needs and wants by the minority?
- thelittleone 6y agoApps in the 90s didn't have user data. I was approximately as productive on apps from the 90s as I am in modern apps today. I am more frequently frustrated by modern apps.
- vxNsr 6y agoI think this is something we need to study somehow even if it feels very true. I often find myself wondering why they’ve made something worse than it was a few years ago. Many parts of iOS and windows 10 have degraded from what they were.
- arsenalist 6y agoIsn't there already an OSS version of the Code - https://flathub.org/apps/details/com.visualstudio.code.oss https://flathub.org/apps/details/com.visualstudio.code.oss Or is this Linux only?
- commoner 6y agoThat's a Flatpak version of Visual Studio Code, which only works on Linux. Unfortunately, it's unmaintained and stuck on version 1.41.1 (December 2019). Arch Linux users do have access to a fully open source version of Visual Studio Code in the community repository, which includes access to the Visual Studio Marketplace: https://www.archlinux.org/packages/community/x86_64/code/ https://www.archlinux.org/packages/community/x86_64/code/
- chenzhekl 6y agoNot sure if it's still possible to access the vast extension marketplace from Microsoft, which is the true value. If I remember correctly, that can only be accessed from the VS Code released by Microsoft. https://cdn.vsassets.io/v/M146_20190123.39/_content/Microsoft-Visual-Studio-Marketplace-Terms-of-Use.pdf https://cdn.vsassets.io/v/M146_20190123.39/_content/Microsof...
- kova12 6y agoExtension marketplace access it might, but I wonder if the .NET debugger will work with it. I remember it was specifically prohibited to run on the non-microsoft built vscode. Without this extension, the .NET coding experience is very meh
- vxNsr 6y agoWhy would you code .Net in vscode vs VS Community Edition (or one of the premium editions)? I find vs ce much better than vscode for .net stuff.
- Kipters 6y agoFull-blown VS is not available on Linux
- vxNsr 6y agoFair. I was gonna ask why do .Net on Linux but then I remembered they OSS’ed it
- foxrob92 6y ago.NET core works pretty well on Linux - I have an ASP.NET Core side project and work exclusively from a Linux machine. The other two maintainers work from Macs.
- Kipters 6y agoYep, it also works fairly well. I'm maintaining a couple services at my day job that are designed to only work on Linux. VS Code is also involved because we're heavily using the Remote Development feature (which only works in MSFT's VS Code, not in VSCodium, because of licensing) to run the IDE core inside the container, so the dev environment is well standardized and portable across devs/host OS
- chickenpotpie 6y agoSomebody correct me if I'm wrong, but I'm pretty sure Amazon recommends using this to their employees to prevent Microsoft tracking.
- lordofgibbons 6y agoI'm not sure about now, but as of last year, the simply had instructions on how to disable the telemetry from VSCode.
- paulcarroty 6y agoPoint to block telemetry before first run.
- itsbits 6y agoYou don't need to remove branding to disable tracking for corporates like Amazon. For example, They might have some firewall in the network which blocks tracking API.
- whatshisface 6y agoYou need to remove branding to be allowed by Microsoft to distribute an unofficial build. You need to distribute an unofficial build to make sure that the application isn't trying to find holes that might have been accidentally left in your firewall. (Quick, without googling, which ports and dest IPs do you need to block? Which ports/dest IPs will you need to block in the next version that hasn't been released yet? Yeah, a losing battle.)
- cercatrova 6y agoNote that this doesn't work with VSCode's Remote extensions, such as for SSH, Docker containers, and WSL. Those extensions are closed source and explicitly check that they're running on only VSCode. I thought of using this but since I mainly use WSL, this doesn't work for me. Still, a laudable effort.
- hardwaresofton 6y agoForgive the kneejerk reaction but it sounds like we've come full circle back to closed source IDEs. For what reason are any of those extensions closed source? Why are people using and championing tools with closed source extensions that check what they're running on (in order to force you to use/buy the original thing) in 2020? You can pry emacs/vim from my cold dead hands -- Microsoft is trying (and succeeding) in google-chrome-ing it's way into the productive developer space. If that's true, I wonder what the Firefox in this analogy is? Atom? Emacs/Vim?
- statictype 6y agoOne possible reason is for security/abuse? I assume these extensions require communicating with some central server (owned by Microsoft) to exchange information with peers at some point during its use. Allowing the extension to run in contexts outside of VS Code could be an issue for them?
- hardwaresofton 6y ago> One possible reason is for security/abuse? > I assume these extensions require communicating with some central server (owned by Microsoft) to exchange information with peers at some point during its use. So I'm no WSL expert but why would Windows Subsystem for Linux or SSH need to communicate with some central server? Also unless they're doing some obfuscation, you're going to see those URLs in the binary to start with, no? Or you just... watch where it calls out to? > Allowing the extension to run in contexts outside of VS Code could be an issue for them? How? If it's a warranty issue then they should just issue the right statements in the license and make sure no one is under the impression that there's a warranty attached? I tried to think of some too but security doesn't pass my admittedly simple sniff test.
- mister_hn 6y agothis is at least the 10th HN post about VSCodium.
- cachestash 6y agoCan anyone explain to me why I should be concerned about vs code telemetry? I have zero personal information in the IDE and all the code I work on is already in the public domain with an open source license, so why should I care?
- nightowl_games 6y agoI value silence in my network traffic.
- DoingIsLearning 6y agoIt's interesting, if we look at the size of webpages in everyday browsing, which can go from tens of megabytes to a few kilobytes when blocking tracking/analytics scripts. I wonder what would be the back of the napkin calculations for network traffic and energy savings (local and server side) of regulating tracking and telemetry? Is there an environmental case to be made against modern web practices on tracking and telemetry?
- luckylion 6y agoI've really come to dislike Google over the past decade or so, but I do like that their Speedtests, Lighthouse etc don't hide this fact from you. Pretty much all sites I've been asked to look at were getting low scores because of Google Tag Manager, Adsense and the like. It has a very measurable impact, and yeah, removing it speeds up the page. The environmental case will probably not fly for regulation, but it just might in public shaming of large companies. "Hey, $company, your usage of $trackingTech uses as much power per year as an average family of four. Is that really in line with your green approach?"
- gdmka 6y agoThank you! This is exactly one of the reasoning pillars i'm using in arguments about the "innocuous" nature of telemetry and tracking. Any new product that collects telemetry/does tracking requires storage that is bought and connected to a power source with high availability given it performs I/O all the time.
- blackoil 6y agoIs there a listing maintained of all the telemetry info. sent? I personally am not in principle against telemetry, if they do not leak any private info. and are not to chatty.
- dastx 6y agoNote that this only includes Microsoft's telemetry, and it seems that Microsoft uses the built in telemetry tooling within their extensions. However, community extensions can still use their own telemetry, which this wouldn't prevent.
- deleted 6y ago[deleted]
- kekebo 6y agoHow does this differ from disabling telemetry in VSCode's settings? The documentation doesn't seem to include a comparison
- floatingatoll 6y agoThis is the right way to lay out a fork. It can be clearly traced and reviewed in a short amount of time. I’ll still use mainline VSCode but it’s nice to see someone handling the “just one purpose” approach without throwing in a lot of other unnecessary things.