5 ms·

Good reason to stay away from those extensions!

by skohan 4y ago

bmitc 4y ago
Is there an actual reason or just "reasons"? Because those extensions are extremely useful and enabling. I honestly am not sure how to live without them at this point. I use all three of the remote development extensions on a daily basis. https://code.visualstudio.com/docs/remote/remote-overview https://code.visualstudio.com/docs/remote/remote-overview
- dhruvdh 4y ago
  There is no actual reason to avoid proprietary builds from Microsoft either, just people on this thread being weird about telemetry.
  - boudin 4y ago
    Wanting to avoid running propietary software is a valid reason. It's opinion based, but valid.
    - mekster 4y ago
      You'll be missing so much out of your life, not sure what to say.
      - boudin 4y ago
        What does that even mean? Running closed source software is a life goal?
        skohan 4y ago
        It’s complete nonsense, I cannot imagine what they are talking about.
  - krageon 4y ago
    > no actual reason You don't know what they're doing and can't know updates are and will stay benign. Anyone signing an NDA that uses it is irresponsible/negligent, unless it is a controlled security exception (or firewalled in some way - but if it can't connect out half the point of the editor is gone).
    - dhruvdh 4y ago
      Are we talking about the same Telemetry that can be turned off? If you work in such an environment, I imagine you can only use approved, audited software - so you don't have an option.
      - bmitc 4y ago
        Exactly. And it's not like switching to a third-party product is anymore secure. Imagine justifying to your security and IT teams that instead of using a Microsoft product, you'd rather use a product forked from it that's developed by random people.
        skohan 4y ago
        This sounds like security theater. Imagine thinking that widely used OSS projects are unsafe and MS products are the only acceptable choice.
        bmitc 4y ago
        I actually think the opposite is security theater. I think the security question is a bit of a wash in general, but I think that in this case, yes, the Microsoft product is likely more secure. How many full time employees are working on VS Code versus VSCodium? FOSS software is not this paragon of security. And the existence of VSCodium is due to telemetry that basically reports nothing, can be inspected, and can be turned off. I don’t see where the security threat is.
        skohan 4y ago
- ohthehugemanate 4y ago
  From https://code.visualstudio.com/docs/remote/faq#_why-arent-the-remote-development-extensions-or-their-components-open-source https://code.visualstudio.com/docs/remote/faq#_why-arent-the... : "The Visual Studio Code Remote Development extensions and their related components use an open planning, issue, and feature request process, but are not currently open source. The extensions share source code which is also used in fully managed remote development services like GitHub Codespaces and their related extensions. Given that these services also will support other proprietary products (for example Visual Studio IDE), the extensions are available under a Microsoft pre-release license like other service-based, cross-product extensions such as Visual Studio IntelliCode and Visual Studio Live Share were during their preview periods."
  - bmitc 4y ago
    Yes, and?
- skohan 4y ago
  > I honestly am not sure how to live without them at this point. That's exactly why. I prefer not to have a workflow which depends on proprietary software. What are you going to do if MS breaks your workflow at some point in the future and you've become dependent on it? Not that everyone has to do that, but it's totally possible to have a FOSS workflow, and I prefer to work that way.
  - bmitc 4y ago
    >> I honestly am not sure how to live without them at this point. > That's exactly why. I prefer not to have a workflow which depends on proprietary software. What are you going to do if MS breaks your workflow at some point in the future and you've become dependent on it? The comment you quoted is hyperbole. What is the actual worry or problem here? No other tool has the convenience of VS Code right now, so am I supposed to just use something else that has reduced functionality for me because of some nebulous worry? What's the specific worry? Because I don't see an actual one beside some strange commitment to FOSS software. If Microsoft suddenly deletes VS Code or requires some inordinate amount of payment to keep using it, both unlikely scenarios, then I would just use something else. It's not like my world would suddenly end, my software would stop working, and I would forget how to write software. In such an unlikely case, the inconvenience would be both that VS Code goes away but then also that nothing else has such useful features.
    - mekster 4y ago
      "I'm fully open source, I'm cool." Probably someone who has no deadlines.
      - skohan 4y ago
        It's all about what you invest in. I've been working with FOSS tools for years, and it takes a while to get your workflows figured out, but I would say I am pretty fast and productive now
    - skohan 4y ago
      Yeah I think it's always fine to use the most expedient tool for the job. Personally, when I am choosing what to invest my time in, I would rather choose FOSS tools which I know to be independent of corporate interests. I admit it's a somewhat abstract risk, but what makes me hesitant about proprietary tools is not any one thing, but how you can gradually get embedded in a proprietary workflow. Maybe now it's only remote/ssh, but maybe next you're using some feature that's built on top of that, and a year down the road you're in a position where you would have to refactor your whole project structure and CI setup to use a different set of tools, and maybe convince your team to do the same. And maybe it's a bit philosophical, but I'm not wild about how MS and others blur the lines between what's open and what's proprietary.
- digisign 4y ago
  sshfs works fine and is only a little bit less efficient.
esjeon 4y ago
TBH, those extensions are biased enough that it's difficult to integrate them into the company-wide workflow. It works okay-ish for personal uses, but still feels kinda awkward.
lfkdev 4y ago
Sadly, I could never work without remote SSH. It's an awesome extension.
- skohan 4y ago
  What advantage do you feel that remote ssh offers over just having a traditional CI pipeline?
Grimburger 4y ago
I do a bit of arm development that runs via ssh build servers. Do actually use VSCodium by default but still need a copy of VSCode to play nicely with all this stuff. It's a weird situation, I'd like to go full codium but it's just not possible in my case hey.
- mekster 4y ago
  What do you actually get by going VSCodium?

Good reason to stay away from those extensions!

by skohan 4y ago

Good reason to stay away from those extensions!

Is there an actual reason or just "reasons"? Because those extensions are extremely useful and enabling. I honestly am not sure how to live without them at this point. I use all three of the remote development extensions on a daily basis. https://code.visualstudio.com/docs/remote/remote-overview https://code.visualstudio.com/docs/remote/remote-overview

dhruvdh 4y ago
There is no actual reason to avoid proprietary builds from Microsoft either, just people on this thread being weird about telemetry.
- boudin 4y ago
  Wanting to avoid running propietary software is a valid reason. It's opinion based, but valid.
  - mekster 4y ago
    You'll be missing so much out of your life, not sure what to say.
    - boudin 4y ago
      What does that even mean? Running closed source software is a life goal?
      - skohan 4y ago
        It’s complete nonsense, I cannot imagine what they are talking about.
- krageon 4y ago
  > no actual reason You don't know what they're doing and can't know updates are and will stay benign. Anyone signing an NDA that uses it is irresponsible/negligent, unless it is a controlled security exception (or firewalled in some way - but if it can't connect out half the point of the editor is gone).
  - dhruvdh 4y ago
    Are we talking about the same Telemetry that can be turned off? If you work in such an environment, I imagine you can only use approved, audited software - so you don't have an option.
    - bmitc 4y ago
      Exactly. And it's not like switching to a third-party product is anymore secure. Imagine justifying to your security and IT teams that instead of using a Microsoft product, you'd rather use a product forked from it that's developed by random people.
      - skohan 4y ago
        This sounds like security theater. Imagine thinking that widely used OSS projects are unsafe and MS products are the only acceptable choice.
        bmitc 4y ago
        I actually think the opposite is security theater. I think the security question is a bit of a wash in general, but I think that in this case, yes, the Microsoft product is likely more secure. How many full time employees are working on VS Code versus VSCodium? FOSS software is not this paragon of security. And the existence of VSCodium is due to telemetry that basically reports nothing, can be inspected, and can be turned off. I don’t see where the security threat is.
        skohan 4y ago
ohthehugemanate 4y ago
From https://code.visualstudio.com/docs/remote/faq#_why-arent-the-remote-development-extensions-or-their-components-open-source https://code.visualstudio.com/docs/remote/faq#_why-arent-the... : "The Visual Studio Code Remote Development extensions and their related components use an open planning, issue, and feature request process, but are not currently open source. The extensions share source code which is also used in fully managed remote development services like GitHub Codespaces and their related extensions. Given that these services also will support other proprietary products (for example Visual Studio IDE), the extensions are available under a Microsoft pre-release license like other service-based, cross-product extensions such as Visual Studio IntelliCode and Visual Studio Live Share were during their preview periods."
- bmitc 4y ago
  Yes, and?
skohan 4y ago
> I honestly am not sure how to live without them at this point. That's exactly why. I prefer not to have a workflow which depends on proprietary software. What are you going to do if MS breaks your workflow at some point in the future and you've become dependent on it? Not that everyone has to do that, but it's totally possible to have a FOSS workflow, and I prefer to work that way.
- bmitc 4y ago
  >> I honestly am not sure how to live without them at this point. > That's exactly why. I prefer not to have a workflow which depends on proprietary software. What are you going to do if MS breaks your workflow at some point in the future and you've become dependent on it? The comment you quoted is hyperbole. What is the actual worry or problem here? No other tool has the convenience of VS Code right now, so am I supposed to just use something else that has reduced functionality for me because of some nebulous worry? What's the specific worry? Because I don't see an actual one beside some strange commitment to FOSS software. If Microsoft suddenly deletes VS Code or requires some inordinate amount of payment to keep using it, both unlikely scenarios, then I would just use something else. It's not like my world would suddenly end, my software would stop working, and I would forget how to write software. In such an unlikely case, the inconvenience would be both that VS Code goes away but then also that nothing else has such useful features.
  - mekster 4y ago
    "I'm fully open source, I'm cool." Probably someone who has no deadlines.
    - skohan 4y ago
      It's all about what you invest in. I've been working with FOSS tools for years, and it takes a while to get your workflows figured out, but I would say I am pretty fast and productive now
  - skohan 4y ago
    Yeah I think it's always fine to use the most expedient tool for the job. Personally, when I am choosing what to invest my time in, I would rather choose FOSS tools which I know to be independent of corporate interests. I admit it's a somewhat abstract risk, but what makes me hesitant about proprietary tools is not any one thing, but how you can gradually get embedded in a proprietary workflow. Maybe now it's only remote/ssh, but maybe next you're using some feature that's built on top of that, and a year down the road you're in a position where you would have to refactor your whole project structure and CI setup to use a different set of tools, and maybe convince your team to do the same. And maybe it's a bit philosophical, but I'm not wild about how MS and others blur the lines between what's open and what's proprietary.
digisign 4y ago
sshfs works fine and is only a little bit less efficient.

esjeon 4y ago

TBH, those extensions are biased enough that it's difficult to integrate them into the company-wide workflow. It works okay-ish for personal uses, but still feels kinda awkward.

lfkdev 4y ago

Sadly, I could never work without remote SSH. It's an awesome extension.

skohan 4y ago
What advantage do you feel that remote ssh offers over just having a traditional CI pipeline?

Grimburger 4y ago

I do a bit of arm development that runs via ssh build servers. Do actually use VSCodium by default but still need a copy of VSCode to play nicely with all this stuff. It's a weird situation, I'd like to go full codium but it's just not possible in my case hey.

mekster 4y ago
What do you actually get by going VSCodium?