4 ms·

Because maybe developers in your bank or hospital are using IDEs with nasty telemetry that might expose data on you? Maybe they are editing a branch called "wor

by 0x0 6y ago

Because maybe developers in your bank or hospital are using IDEs with nasty telemetry that might expose data on you? Maybe they are editing a branch called "workaround-for-mr-cachestash-bankrupcy-account-bug"?

aspyct 6y ago
Never say never, but still, this is super unlikely and not at all what telemetry is. They report on things like button usage, time spent in app etc. Possibly personal information about the developer, although unlikely. But your code? No no, they're probably not looking at your buggy code...
- Xelbair 6y ago
  and how do you know that? did you check the source? oh wait..
  - aspyct 6y ago
    And how exactly do you think they would look at all the source code in the world? Humans are too expensive. So probably AI. How would AI tell the difference between valuable banking software full of bugs and your side project full of bugs? Also from there, why would you include a customer's personal information in your code, or even have it on your own machine? Really, the chances of vscode's telemetry leaking personal user information is super extra low, unless you're obviously doing something wrong with your code. Ah, and finally, if you're using github, they have a much more efficient way of getting your code anyway.
- 0x0 6y ago
  Microsoft has been known to do things like log all command line arguments in dotnet, for example https://docs.microsoft.com/en-us/dotnet/core/tools/telemetry https://docs.microsoft.com/en-us/dotnet/core/tools/telemetry And then they post the results publicly. https://devblogs.microsoft.com/dotnet/what-weve-learned-from-net-core-sdk-telemetry/ https://devblogs.microsoft.com/dotnet/what-weve-learned-from...
  - aspyct 6y ago
    Indeed. And since they are very open as to what they collect, feel free to point out anything disturbing. As for the publicly posted results, it seems to me like they try to understand who uses their products and how. That's not worse than basic website analytics, and that's data they certainly need in order to prioritise their development. But I may be missing your point. Can you point to a specific datapoint in those documents that you object to, and explain why?
    - 0x0 6y ago
      When they post full csv files with all kinds of command line arguments including typos, who's to know your "dotnet run fix-aspycts-bankrupcy-account" command, where you forgot the first "run" argument, won't end up in a csv some day?
      - aspyct 6y ago
        Except that they don't seem to be recording the arguments to `dotnet run`: https://docs.microsoft.com/en-us/dotnet/core/tools/telemetry#collected-options https://docs.microsoft.com/en-us/dotnet/core/tools/telemetry...
        0x0 6y ago
        So you typo and forget the "run" part. Now what? I can't believe I have to argue about how bad it is to have CLI tools send their arguments as telemetry. Even half-arsed lately introduced attempts at redaction doesn't change the fact that the entire mindset of the developers are poison.
        aspyct 6y ago
        If you'd taken the time to read the documents you linked to, you would realise that they do _not_ record arbitrary strings. I can't believe people don't even read the "proof" they provide themselves.

by 0x0 6y ago

aspyct 6y ago

Never say never, but still, this is super unlikely and not at all what telemetry is. They report on things like button usage, time spent in app etc. Possibly personal information about the developer, although unlikely. But your code? No no, they're probably not looking at your buggy code...

Xelbair 6y ago
and how do you know that? did you check the source? oh wait..
- aspyct 6y ago
  And how exactly do you think they would look at all the source code in the world? Humans are too expensive. So probably AI. How would AI tell the difference between valuable banking software full of bugs and your side project full of bugs? Also from there, why would you include a customer's personal information in your code, or even have it on your own machine? Really, the chances of vscode's telemetry leaking personal user information is super extra low, unless you're obviously doing something wrong with your code. Ah, and finally, if you're using github, they have a much more efficient way of getting your code anyway.
0x0 6y ago
Microsoft has been known to do things like log all command line arguments in dotnet, for example https://docs.microsoft.com/en-us/dotnet/core/tools/telemetry https://docs.microsoft.com/en-us/dotnet/core/tools/telemetry And then they post the results publicly. https://devblogs.microsoft.com/dotnet/what-weve-learned-from-net-core-sdk-telemetry/ https://devblogs.microsoft.com/dotnet/what-weve-learned-from...
- aspyct 6y ago
  Indeed. And since they are very open as to what they collect, feel free to point out anything disturbing. As for the publicly posted results, it seems to me like they try to understand who uses their products and how. That's not worse than basic website analytics, and that's data they certainly need in order to prioritise their development. But I may be missing your point. Can you point to a specific datapoint in those documents that you object to, and explain why?
  - 0x0 6y ago
    When they post full csv files with all kinds of command line arguments including typos, who's to know your "dotnet run fix-aspycts-bankrupcy-account" command, where you forgot the first "run" argument, won't end up in a csv some day?
    - aspyct 6y ago
      Except that they don't seem to be recording the arguments to `dotnet run`: https://docs.microsoft.com/en-us/dotnet/core/tools/telemetry#collected-options https://docs.microsoft.com/en-us/dotnet/core/tools/telemetry...
      - 0x0 6y ago
        So you typo and forget the "run" part. Now what? I can't believe I have to argue about how bad it is to have CLI tools send their arguments as telemetry. Even half-arsed lately introduced attempts at redaction doesn't change the fact that the entire mindset of the developers are poison.
        aspyct 6y ago
        If you'd taken the time to read the documents you linked to, you would realise that they do _not_ record arbitrary strings. I can't believe people don't even read the "proof" they provide themselves.