3 ms·

Are we talking about the same Telemetry that can be turned off? If you work in such an environment, I imagine you can only use approved, audited software - so y

Are we talking about the same Telemetry that can be turned off? If you work in such an environment, I imagine you can only use approved, audited software - so you don't have an option.

bmitc 4y ago
Exactly. And it's not like switching to a third-party product is anymore secure. Imagine justifying to your security and IT teams that instead of using a Microsoft product, you'd rather use a product forked from it that's developed by random people.
- skohan 4y ago
  This sounds like security theater. Imagine thinking that widely used OSS projects are unsafe and MS products are the only acceptable choice.
  - bmitc 4y ago
    I actually think the opposite is security theater. I think the security question is a bit of a wash in general, but I think that in this case, yes, the Microsoft product is likely more secure. How many full time employees are working on VS Code versus VSCodium? FOSS software is not this paragon of security. And the existence of VSCodium is due to telemetry that basically reports nothing, can be inspected, and can be turned off. I don’t see where the security threat is.
    - skohan 4y ago
      This is a terrible take. Why on earth would you trust a closed source, corporate solution more than FOSS sostare? The FOSS solution can be audited and the closed source solution can not. Your opinion is incorrect.
    - krageon 4y ago
      > the Microsoft product is likely more secure This is nonsense, because it patently is security theater. Earlier I was addressing the fact that to look good to a judge or lawyer, you need to do things that are dumb but very strict. That has nothing to do with reality and we shouldn't start pretending it does: The OSS is likely better in every way than what you'll buy (even if it's just because it does the same thing but is much cheaper). > telemetry that [...] can be inspected The telemetry cannot be meaningfully inspected, because it may change at any time. You know what it has sent just now, not what it'll send 5 minutes from now. > telemetry that [...] can be turned off You cannot know that it was turned off. Historically, MS doesn't respect your choice to turn it off once and will just turn it back on later for whatever reason. Aside from that, you cannot inspect the binary in a meaningful way so you don't know what it will do 5 minutes from now.

Are we talking about the same Telemetry that can be turned off? If you work in such an environment, I imagine you can only use approved, audited software - so you don't have an option.

bmitc 4y ago

Exactly. And it's not like switching to a third-party product is anymore secure. Imagine justifying to your security and IT teams that instead of using a Microsoft product, you'd rather use a product forked from it that's developed by random people.

skohan 4y ago
This sounds like security theater. Imagine thinking that widely used OSS projects are unsafe and MS products are the only acceptable choice.
- bmitc 4y ago
  I actually think the opposite is security theater. I think the security question is a bit of a wash in general, but I think that in this case, yes, the Microsoft product is likely more secure. How many full time employees are working on VS Code versus VSCodium? FOSS software is not this paragon of security. And the existence of VSCodium is due to telemetry that basically reports nothing, can be inspected, and can be turned off. I don’t see where the security threat is.
  - skohan 4y ago
    This is a terrible take. Why on earth would you trust a closed source, corporate solution more than FOSS sostare? The FOSS solution can be audited and the closed source solution can not. Your opinion is incorrect.
  - krageon 4y ago
    > the Microsoft product is likely more secure This is nonsense, because it patently is security theater. Earlier I was addressing the fact that to look good to a judge or lawyer, you need to do things that are dumb but very strict. That has nothing to do with reality and we shouldn't start pretending it does: The OSS is likely better in every way than what you'll buy (even if it's just because it does the same thing but is much cheaper). > telemetry that [...] can be inspected The telemetry cannot be meaningfully inspected, because it may change at any time. You know what it has sent just now, not what it'll send 5 minutes from now. > telemetry that [...] can be turned off You cannot know that it was turned off. Historically, MS doesn't respect your choice to turn it off once and will just turn it back on later for whatever reason. Aside from that, you cannot inspect the binary in a meaningful way so you don't know what it will do 5 minutes from now.