5 ms·

Hey folks, Geoff here from Gitpod. Very pleased to see there continues to be strong interest in open (and FOSS) software development tooling. VSCodium uses the

Hey folks, Geoff here from Gitpod. Very pleased to see there continues to be strong interest in open (and FOSS) software development tooling. VSCodium uses the OpenVSX registry (which Gitpod folks created) because the VS Market place is proprietary and can only be connected to from official Visual Studio branded products. If you can't find an extension when using VSCodium then please send a pull-request to this repository https://github.com/open-vsx/publish-extensions https://github.com/open-vsx/publish-extensions with the identifier and that will help grow the ecosystem of open tooling. ICMYI - We blogged more about this over at: - https://www.gitpod.io/blog/cloud-ide-history https://www.gitpod.io/blog/cloud-ide-history - https://www.gitpod.io/blog/openvscode-server-launch https://www.gitpod.io/blog/openvscode-server-launch - https://www.gitpod.io/blog/open-vsx https://www.gitpod.io/blog/open-vsx If you got any questions lemme know. <3

frostwarrior 4y ago
There are many extensions that break in VSCodium because they expect the "code" binary. Where can I report that?
- filiptronicek 4y ago
  Hi, Filip from Gitpod here! It is a bit puzzling to me that this would be an issue, since extensions generally do not call any VS Code binaries, they should ideally access everything through the VS Code Extension API (https://code.visualstudio.com/api https://code.visualstudio.com/api) and never call any VS Code-related binaries, since VS Code can run on a portable mode as well. If issues like this arise, it is most likely a fault of the extension itself, so reporting should be done on a repository or an issue tracker of that extension. I have never seen an extension call the `code` binary, so I would guess it could realistically only be helpful for some kind of a workaround for an API limitation. If you have any of these extensions that break on VS Codium, could you please share them with me? I would love to dig for more and help towards fixing said extensions there.
rufugee 4y ago
Is there a way to tie VSCode extensions to their VSCodium counterparts? I installed codium and started manually installing plugins, but realized that authors, etc don't match up. For example, the Rails plugin in official VSCode shows "周鹏" as the author and 245K downloads, but in codium it's "bung87" with only 3.9K downloads. I'm just thinking about supply chain attacks. I don't personally review all extension code on the VSCode side, but there's a certain amount of (false) comfort when over 200K folks have downloaded a particular extension.
- filiptronicek 4y ago
  Hi there, Filip from Gitpod here. The discrepancies you mentioned come down to the extension Marketplace used - in VS Code, it is the Microsoft VS Code Marketplace, but in VS Codium it is by default https://open-vsx.org/ https://open-vsx.org/ (basically a FOSS alternative to the Microsoft one). The names don’t match up, because on Microsoft’s Marketplace the author handle (display name) is used, but Open VSX returns the username as the author name. The username of the author 周鹏 is bung87 on both the Microsoft Marketplace and OpenVSX. I think this is a good thing to reconsider though and thanks a lot for sharing! > with only 3.9K downloads The difference in the download numbers is as simple as the Microsoft Marketplace having their own install counter; Open VSX has less users and therefore less downloads for the extension. It is true that Open VSX’s approach can be potentially dangerous, since an extension A on the VS Code Marketplace does not have to be the same extension A , it is built on the belief that people will be taking only their namespaces. The verification check mark can help on Open VSX extension pages with this, but it is not available on the VS Code side (yet anyway :)). The Rails extension you mentioned has the checkmark, so it means that it is published by someone who is a part of the project. You can take a look at how it looks like on the extension page: https://open-vsx.org/extension/bung87/rails https://open-vsx.org/extension/bung87/rails.
  - nybble41 4y ago
    Open VSX (and perhaps VS Code Marketplace) might consider adding support for identity verification through Keyoxide[0]. This would allow interested parties to easily determine whether the user bung87 on Open VSX and the user bung87 on VS Code Marketplace are really the same person and not just someone claiming the same username. There is already support for linking Keyoxide to one's GitHub account and even Hacker News, among other service providers. [0] https://docs.keyoxide.org/advanced/for-service-providers/ https://docs.keyoxide.org/advanced/for-service-providers/
legalcorrection 4y ago
What is the obstacle to connecting codium to the VS Marketplace? Technical or legal?
- filiptronicek 4y ago
  For sure legal. Technically, it's extremely simple to change the Marketplace in VS Codium, but it is against the ToS of Microsoft's Marketplace to change it to theirs (see https://github.com/microsoft/vscode/issues/31168#issuecomment-1136375670 https://github.com/microsoft/vscode/issues/31168#issuecommen... for more details). As the linked comment also states, this is a big part of the reason why Open VSX was created and is widely used by VS Code forks.
  - netr0ute 4y ago
    Why would this be an issue? The code itself can't agree to the ToS, so only people using it could possibly do so, and depending on how the connection is set up, they might be able to skip agreeing to the ToS since that's just a client-side construction in MS VS (I hope).
    - yebyen 4y ago
      So then the user can make the change, and then it's the user's ToS violation. If the publisher makes this change in public then it's their ToS violation with receipts. I don't think you're really arguing that the VSCodium folks should make this change in violation of the ToS, sign it, and package it up... They have built this whole alternative ecosystem so they can be in compliance.
j0057 4y ago
Is vscodium usable for .NET development and debugging?
- unclad5968 4y ago
  The C# extension from the open-vsx repository is from Samsung. I've never used it but it looks like it uses omnisharp just like the MS version. I would say yes, it is usable.
- ghuntley 4y ago
  Yes, through the Samsung debugger. See https://isdotnetopen.com https://isdotnetopen.com for more information about remaining problems in the .net ecosystem. dotnet claims to be open but it really isn’t yet unfortunately…
- ejanus 4y ago
  Which other debugger could one use with VS code that is not from Microsoft?
cowmix 4y ago
Last time I looked the whole dev over SSH was not supported by VSCodium. Is that going to change in the near future?
- lawik 4y ago
  That's a proprietary Microsoft one. Same with LiveShare. Probably a few more.
  - 5e92cb50239222b 4y ago
    C++ support, too. Thankfully there's a decent alternative in clangd (which is also available in many other editors).
  - jraph 4y ago
    LiveShare has a good open source replacement: CodeTogether.
  - brundolf 4y ago
    Interesting to see which pieces of functionality they consider to be part of their moat vs commoditizing them
CalChris 4y ago
I installed it via homebrew on an M1 and got “VSCodium” can’t be opened because Apple cannot check it for malicious software. From what I can tell from https://github.com/VSCodium/vscodium/issues/228 https://github.com/VSCodium/vscodium/issues/228 I have to self sign. This seems like a security hole to me.
- brundolf 4y ago
  You should be able to override that warning in system settings. They make it inconvenient on purpose, and it's per-app, but you only have to do it once per app
- quinncom 4y ago
  The first time you launch vscodium, don't do so via "Open" or double-click; instead, right-click and choose open. This will give you the option to bypass macOS's GateKeeper just once, after which you can launch the app normally.
- BossingAround 4y ago
  You use macOS, which deliberately tries to kill off apps that do not come through the app store (i.e. apps that Apple doesn't get a cut off of)
asddubs 4y ago
does this allow only open source extensions, or proprietary ones as well? If it's the latter, is there a way to filter for only foss extensions? I don't use vscode/vscodium mostly because I didn't want to get suckered into having an open source trojan horse bring a bunch of proprietary crap into my system

frostwarrior 4y ago

There are many extensions that break in VSCodium because they expect the "code" binary. Where can I report that?

filiptronicek 4y ago
Hi, Filip from Gitpod here! It is a bit puzzling to me that this would be an issue, since extensions generally do not call any VS Code binaries, they should ideally access everything through the VS Code Extension API (https://code.visualstudio.com/api https://code.visualstudio.com/api) and never call any VS Code-related binaries, since VS Code can run on a portable mode as well. If issues like this arise, it is most likely a fault of the extension itself, so reporting should be done on a repository or an issue tracker of that extension. I have never seen an extension call the `code` binary, so I would guess it could realistically only be helpful for some kind of a workaround for an API limitation. If you have any of these extensions that break on VS Codium, could you please share them with me? I would love to dig for more and help towards fixing said extensions there.

rufugee 4y ago

Is there a way to tie VSCode extensions to their VSCodium counterparts? I installed codium and started manually installing plugins, but realized that authors, etc don't match up. For example, the Rails plugin in official VSCode shows "周鹏" as the author and 245K downloads, but in codium it's "bung87" with only 3.9K downloads. I'm just thinking about supply chain attacks. I don't personally review all extension code on the VSCode side, but there's a certain amount of (false) comfort when over 200K folks have downloaded a particular extension.

filiptronicek 4y ago
Hi there, Filip from Gitpod here. The discrepancies you mentioned come down to the extension Marketplace used - in VS Code, it is the Microsoft VS Code Marketplace, but in VS Codium it is by default https://open-vsx.org/ https://open-vsx.org/ (basically a FOSS alternative to the Microsoft one). The names don’t match up, because on Microsoft’s Marketplace the author handle (display name) is used, but Open VSX returns the username as the author name. The username of the author 周鹏 is bung87 on both the Microsoft Marketplace and OpenVSX. I think this is a good thing to reconsider though and thanks a lot for sharing! > with only 3.9K downloads The difference in the download numbers is as simple as the Microsoft Marketplace having their own install counter; Open VSX has less users and therefore less downloads for the extension. It is true that Open VSX’s approach can be potentially dangerous, since an extension A on the VS Code Marketplace does not have to be the same extension A , it is built on the belief that people will be taking only their namespaces. The verification check mark can help on Open VSX extension pages with this, but it is not available on the VS Code side (yet anyway :)). The Rails extension you mentioned has the checkmark, so it means that it is published by someone who is a part of the project. You can take a look at how it looks like on the extension page: https://open-vsx.org/extension/bung87/rails https://open-vsx.org/extension/bung87/rails.
- nybble41 4y ago
  Open VSX (and perhaps VS Code Marketplace) might consider adding support for identity verification through Keyoxide[0]. This would allow interested parties to easily determine whether the user bung87 on Open VSX and the user bung87 on VS Code Marketplace are really the same person and not just someone claiming the same username. There is already support for linking Keyoxide to one's GitHub account and even Hacker News, among other service providers. [0] https://docs.keyoxide.org/advanced/for-service-providers/ https://docs.keyoxide.org/advanced/for-service-providers/

legalcorrection 4y ago

What is the obstacle to connecting codium to the VS Marketplace? Technical or legal?

filiptronicek 4y ago
For sure legal. Technically, it's extremely simple to change the Marketplace in VS Codium, but it is against the ToS of Microsoft's Marketplace to change it to theirs (see https://github.com/microsoft/vscode/issues/31168#issuecomment-1136375670 https://github.com/microsoft/vscode/issues/31168#issuecommen... for more details). As the linked comment also states, this is a big part of the reason why Open VSX was created and is widely used by VS Code forks.
- netr0ute 4y ago
  Why would this be an issue? The code itself can't agree to the ToS, so only people using it could possibly do so, and depending on how the connection is set up, they might be able to skip agreeing to the ToS since that's just a client-side construction in MS VS (I hope).
  - yebyen 4y ago
    So then the user can make the change, and then it's the user's ToS violation. If the publisher makes this change in public then it's their ToS violation with receipts. I don't think you're really arguing that the VSCodium folks should make this change in violation of the ToS, sign it, and package it up... They have built this whole alternative ecosystem so they can be in compliance.

j0057 4y ago

Is vscodium usable for .NET development and debugging?

unclad5968 4y ago
The C# extension from the open-vsx repository is from Samsung. I've never used it but it looks like it uses omnisharp just like the MS version. I would say yes, it is usable.
ghuntley 4y ago
Yes, through the Samsung debugger. See https://isdotnetopen.com https://isdotnetopen.com for more information about remaining problems in the .net ecosystem. dotnet claims to be open but it really isn’t yet unfortunately…
ejanus 4y ago
Which other debugger could one use with VS code that is not from Microsoft?

cowmix 4y ago

Last time I looked the whole dev over SSH was not supported by VSCodium. Is that going to change in the near future?

lawik 4y ago
That's a proprietary Microsoft one. Same with LiveShare. Probably a few more.
- 5e92cb50239222b 4y ago
  C++ support, too. Thankfully there's a decent alternative in clangd (which is also available in many other editors).
- jraph 4y ago
  LiveShare has a good open source replacement: CodeTogether.
- brundolf 4y ago
  Interesting to see which pieces of functionality they consider to be part of their moat vs commoditizing them

CalChris 4y ago

I installed it via homebrew on an M1 and got “VSCodium” can’t be opened because Apple cannot check it for malicious software. From what I can tell from https://github.com/VSCodium/vscodium/issues/228 https://github.com/VSCodium/vscodium/issues/228 I have to self sign. This seems like a security hole to me.

brundolf 4y ago
You should be able to override that warning in system settings. They make it inconvenient on purpose, and it's per-app, but you only have to do it once per app
quinncom 4y ago
The first time you launch vscodium, don't do so via "Open" or double-click; instead, right-click and choose open. This will give you the option to bypass macOS's GateKeeper just once, after which you can launch the app normally.
BossingAround 4y ago
You use macOS, which deliberately tries to kill off apps that do not come through the app store (i.e. apps that Apple doesn't get a cut off of)

asddubs 4y ago

does this allow only open source extensions, or proprietary ones as well? If it's the latter, is there a way to filter for only foss extensions? I don't use vscode/vscodium mostly because I didn't want to get suckered into having an open source trojan horse bring a bunch of proprietary crap into my system