13 ms·

VS Code – What's the deal with the telemetry?

194 points by ttctciyf 4y ago

throwaway22032 4y ago
It's Microsoft. It's what they do. It's been 20+ years. I'm not even old. I just don't understand how people haven't figured this out yet.
- edgyquant 4y ago
  Okay but companies don’t just add telemetry because it’s a fun and exciting engineering challenge. They do so for legitimate engineering and business reasons. These solutions have privacy nuance they are not black and white/evil v good
  - belter 4y ago
    Enabled by default -> Bad Give user option to enable to improve product -> Good
    - squarefoot 4y ago
      And possibly keep telemetry data (all of it) auditable by users, so that they know exactly what they are opting in to transmit.
      - edgyquant 4y ago
        If you are doing telemetry in a way that respects privacy this won’t be possible. Or at least there won’t be a way to verify whatever data you have locally to their database
    - hajile 4y ago
      Not to mention that if you do anything requiring security, then this all becomes a giant nightmare that results in the entire editor and toolchain being disallowed.
    - edgyquant 4y ago
      This is a political opinion and regardless an implementation detail. My response was that telemetry serves actual purposes and very useful ones at that. Our goal should be to adapt and ensure privacy via regulations and standards. Wishing, or enforcing, that every application not have telemetry by default is both unrealistic and unwanted.
  - deleted 4y ago
    [deleted]
  - throwaway22032 4y ago
    Telemetry is malware. Always has been.
  - falcolas 4y ago
    My concern is that anybody at a company can suggest a telemetry point and it's added with little or no oversight, and store it forever. It may not be a fun engineering challenge (though it could be, depending on the metric), but sifting through the results is a "fun data interpretation" event. Especially for marketing and sales groups. The solutions should have a privacy nuance... but don't. For example from TFA, collecting git branch and repo names. That seems like a terrible idea, since it's not like Microsoft's devs will have access to reproduce issues from those repos. It's also a potential leak of sensitive corporate data.
  - npteljes 4y ago
    Factory farming is also an engineering challenge, with legitimate business reasons - its way more economical. I think most of the time horrible things just make sense, in some other framing. My point is - something being useful is a very low bar. It's not the point of the discussion here. Maybe some privacy zealots won't acknowledge this, but telemetry can be very useful, and at the same time a breach of privacy. And regarding Microsoft, it's also about their attitude towards it. It's their way or the highway. It has always been like this - the software might be the way it is, but regarding their business dealings they are and always were ruthless. That's what made them great. So now what we see is a continuation of their previous attitude. And a slice of the current zeitgeist which is always-on internet with everyone slurping up user data.
  - squarefoot 4y ago
    Telemetry can be an invaluable source of information to improve products, everyone knows that; it's sorta like having 100% of the users continuously reporting bugs and information from which software vendors can infer most wanted features or modifications to improve usability. Which business wouldn't want that? If done right it could be great for everyone, including users. Unfortunately there's no way to ensure that invaluable tool won't one day be used against users to sneak out data that wouldn't contribute in any way to products improvement, namely making profits from users profiling. But the point isn't being good or evil; businesses have no sense of morals, they don't obey to common sense but rather take the path that leads to the higher profits, and these days profiling users unfortunately brings high profits. It's not a matter of which company is good or bad, or if telemetry can be done right or not, but rather how long until a software with built in telemetry will use it the wrong way, because soon or later everyone of them will be presented the scenario in which doing a bad thing brings them more profits; and this principle applies way beyond telemetry.
- declnz 4y ago
  IMO it's because they've done very smart pivots / rebranding (VSCode, Github, NPM, even the Surfaces) and people who even know start thinking "new Microsoft"
- throwaway642012 4y ago
  I'm old enough to remember the browser wars and FUD against linux. It is funny to see MS going from 'M$' to the gatekeeper of OpenSource.
  - bitwize 4y ago
    "Developers! Developers! Developers! Developers!" They were losing hearts and minds in the Web dev space by waging war against open source. It makes far more sense to co-opt it, as per the Halloween-document strategy. TBH I saw this coming 20 or so years ago, about the time when IBM started putting on its open-source cheerleader outfit. Open source is formless, shapeless, like water per Bruce Lee. You cannot oppose it with force, it will just get everywhere; but by aligning yourself with it you can direct it. That's what I saw IBM doing and I knew Microsoft would follow suit out of lack of choice. And now here we are.
- ajdude 4y ago
  I'm a bit surprised at how many of my friends have jumped ship to Visual Studio Code, including those who are very much for free software. They have always been in the business of embrace, extend, extinguish[0]. People tend to forget how evil M$ used to be because recently they have seemed like a beacon for Open Source, but I think they are just still evil[1]. I think we're still dealing with the same Microsoft that we've dealt with through the 90s. They are not a champion of open source, and they are still up to their old tricks.[2] [0] https://news.ycombinator.com/item?id=31966414 https://news.ycombinator.com/item?id=31966414 [1] https://keivan.io/the-day-appget-died/ https://keivan.io/the-day-appget-died/ [2] https://social.platypush.tech/@blacklight/108719097530863121 https://social.platypush.tech/@blacklight/108719097530863121
ttctciyf 4y ago
Found this while looking for a way to fully disable telemetry on vscode. After reading, this seems impossible, short of going down to DNS or network blocks of some kind: the "disable telemetry" setting doesn't; extensions have their own telemetry; MS consider the data sufficiently anonymous to be exempt from GDPR, even the vscodium maintainers say they found it impossible to block vs code's eager telemetrizing. I wonder what is the most effective way of actually completely stopping it phoning home, apart from yanking its ethernet cable?
- mayoi 4y ago
  You can always simply install a better text editor that doesn't spy on you.
  - ttctciyf 4y ago
    Very true. But I have specific reasons for wanting to use vs code in this instance.
  - bitwize 4y ago
    What better text editor?
    - katbyte 4y ago
      On windows notepad++ was my goto for basic text editing. These days I use the jetbrains editor of choice for the language in question or IntelliJ for basic text.
    - colordrops 4y ago
      Emacs or *vim
      - gabrielgio 4y ago
        And even if you don't like fiddling with dotfiles you can install some really nice distribution like spacemacs or doom for emacs and lunar for neovim. They have a pleasant dev experience out of the box.
NGRhodes 4y ago
Worth noting that extensions may separately send telemetry, that do not have to adhere to the main VSCode telemetry configuration settings.
- gabrielgio 4y ago
  What a gross oversight from their part. Not only they build a product that, as pointed by the post, sends a excessive amount of data, but also allows anyone to do the same. > Why have licenses like these if they are just concerned with product improvement? That nails it for me. I have no reason whatsoever to use vscode.
  - kroltan 4y ago
    What's the alternative? Blocking extensions from accessing the Internet? How are you even supposed to do that given extensions already have (completely justified) access to the filesystem and can invoke executables? There certainly is a valid argument for Internet access, for example for documentation lookup, schema validation, database editing, etc. There would be a strict, and yet fallible, vetting process on the extension marketplace to make sure every extension complies with whatever rules are defined.
    - gabrielgio 4y ago
      You have a point. There is no way to block access to resources given the nature of the product, but they could, at least, make more effort to create a better community/environment around the tooling (regarding data handling). > extensions may separately send telemetry, that do not have to adhere to the main VSCode telemetry configuration settings. From what I see things that should never happen and should yield a block from the marketplace. Like you mention, in the end of the day that is not enforceable, but more transparent data privacy policy would show some good faith from their side.
    - yjftsjthsd-h 4y ago
      > What's the alternative? Expose the setting to extensions (if it isn't already), and set a policy in their extension catalog that extension telemetry must honor the global setting. It isn't perfect, but it's better than nothing.
whywhywhywhy 4y ago
I honestly wouldn't mind the telemetry but seen as VSCode on Windows will always inevitably completely freeze the entire OS to the point of requiring a restart if you leave it open for long enough, it doesn't give me much faith anyone is looking at it that closely in terms of using it to fix fundamental issues.
- nominusllc 4y ago
  I have never experienced this, on any OS.
  - cassianoleal 4y ago
    From all the anecdotes in this thread, I estimate a 50% chance of it happening.
  - whywhywhywhy 4y ago
    It's just Windows and how long are your uptimes and do you leave it open all the time? I know it's not just me because I did find the github issue and there was no fix so I just stopped using VSCode
    - d_tr 4y ago
      I guess you are not referring to some MS extension but to the editor itself, right? I had an issue around a year ago with cpptools on Linux, where a single 80k LOC header would cause obscene memory usage (10+ G) and the extension would basically stop working.
gentleman11 4y ago
Why even make vscode if not for telemetry? It’s the whole point of the app, isn’t it? It’s like chrome or edge or that open source png viewer that started selling your info a few months ago Telemetry is a major focus of windows since the current ceo too over. It’s kind of his thing Note there is an open source version called vscodium that iirc has telemetry disabled but I found my extensions didn’t work with it last year when I tried it
- npteljes 4y ago
  It's good PR for Microsoft.
Bootvis 4y ago
I think I'm out of the loop: what exactly is so valuable about this telemetry? I don't believe my coding habits can be used for advertising.
- api 4y ago
  * Profiling what languages you code in * Profiling your work hours * Tracking the physical locations of software professionals * Profiling the nature of the projects you are working on * Perhaps: training GitHub Copilot?
  - Bootvis 4y ago
    I get these are huge privacy infringements and I don't like that but except for improving Copilot I don't see how they would make money from that. On the other hand, sites such as StackOverflow and Google (possibly even Bing) can get a good guess of the others as well.
    - rightbyte 4y ago
      MS sale team would probably love to get a grep of all "#include <foo.h>" of a company to see of they can do some sales pitch to eat some vendors lunch.
- savanaly 4y ago
  FTA: "Visual Studio Code collects telemetry data, which is used to help understand how to improve the product. For example, this usage data helps to debug issues, such as slow start-up times, and to prioritize new features." I don't work at Microsoft but I work somewhere similar on a product that collects similar types of telemetry and those words are not empty, they are very, very true. We absolutely add, remove, and change things about the UI based on what our telemetry says people do. And it's not just about moving things around (which I know HN hates), it's about making the page load faster (which I know HN loves!). We are going through a concerted effort to lower page TTVC at the moment and a big part is going to have to be turning off some features that show by default that take too long to load and guess how we'll be making the call about which features to turn off?
falcolas 4y ago
Telemetry is godsend for developers, since it lets them track down actual product usage and issues. Telemetry is a privacy nightmare for users, since it sends data to the developers outside of an average user's control - data which is probably easily associated with an individual and kept for eons (disk space is cheap after all). I think telemetry collection is starting to become a professional ethics issue for developers, and should be talked about more.
- phantomathkg 4y ago
  As a developer tool, I think it is absolutely possible for Microsoft and extension developers to write a very deep and detail explanation to the users and explain why do they need to collect what telemetry data. As a user and engineer, I am more than happy to share the usage and crash data with them, but at the same time, I would appreciate if they can be fair to us the user.
  - zerkten 4y ago
    They publish research updates like https://www.microsoft.com/en-us/research/group/experimentation-platform-exp/articles/measurably-improve-your-product-by-combining-qualitative-and-quantitative-methods/ https://www.microsoft.com/en-us/research/group/experimentati....
- bentcorner 4y ago
  What do you think about regulation like the GDPR?
  - falcolas 4y ago
    I like them. I don't really understand how it would apply to telemetry - it's not something I've read into - and I don't think many other folks are looking into GDPR compliance with telemetry either.
    - zerkten 4y ago
      All of the big companies have armies of lawyers deeply familiar with these laws and regulations. They make their engineering teams implement processes to mitigate the issues with storage and processing. Examples: replacing/removing external IDs, ensuring data can't be linked to users, aggregating data, not retaining data, only processing data within data centers (no data extracted to laptops), deleting old data, etc. This is why it's slow and painful to work at big companies compared to startups. It doesn't mean that accidents don't happen, but it's pretty well thought out. The same applies to how they do qualitative research. It's got reasonably high standards which are fairly consistently applied. It's not perfect, but nothing is. There is a lot of job security and motivation for people to make it better. Smaller companies have almost zero understanding of how to deal with this due to lack of resources and expertise. The only way they get compliant is by using good tools which force the user into a safer, more compliant posture.
Lio 4y ago
The TL;DR is Microsoft won't tell you what they collect and ignore settings that limit telemetry. If you use VSCode or its extensions you can't keep commercial secrets from those working at Microsoft unless you block network traffic from VSCode. This seems to be true even in the open source builds like VSCodium.
- webmobdev 4y ago
  > This seems to be true even in the open source builds like VSCodium. Which is ironical given that you should be able to completely strip any telemetry code if the complete source is available ...
- rstat1 4y ago
  So I guess this page on their website is fiction? https://code.visualstudio.com/docs/getstarted/telemetry https://code.visualstudio.com/docs/getstarted/telemetry
  - pseudalopex 4y ago
    The article went into detail about it.
    - jsmith45 4y ago
      Except the article does not. If you turn off telemetry and crash reporting, then there is no telemetry. (Except possibly the telemetry from plugins that choose not to honor the telemetry toggle). This post provides no examples of telemetry being sent when the option is turned off. Now the program does have a variety of spots where it is designed to contact Microsoft services, like say the extension store, or update checks, or other similar functionality. Those services will (obviously) keep some level of logging data, which you cannnot opt out of if VSCode Talks to those services. This is what the terms are talking about when they indicate that not all collected data can be opted out of. There is no "Don't talk to any Microsoft cloud service" feature toggle, sure, but would not really be a sane toggle people actually want. For example that toggle would need to forcibly disable the git support to ensure those features don't try to talk to GitHub if you open code in some GitHub checked out repo. It would disable the extensions store. It would prevent the update checking, etc. VSCodium would end up wanting to rip chunks of that toggle's functionality back out, since for example, VSCodium uses a different non-Microsoft extension store by default, so would want want the extension store to remain disabled.
jacknews 4y ago
There's always vscodium which which doesn't have the tracking, similar to Chromium browser vs Chrome: https://vscodium.com/ https://vscodium.com/
- phantomathkg 4y ago
  As the post mentioned, even the VSCodium team cannot shutdown all telemetry. Seems some do not have switches?
  - jacknews 4y ago
    You are correct, I didn't read the whole thing completely.
  - ensignavenger 4y ago
    Why not just remove it from the source code?
    - 5d8767c68926 4y ago
      Given the frequency of updates, maintaining a privacy fork with anything but minor changes would be a Sisyphean task.
      - npteljes 4y ago
        Which is exactly what I'd expect from a privacy fork.
        phantomathkg 4y ago
        How about we contribute back the changes needed?
        npteljes 4y ago
        You mean, you and I should team up for some quality free software work?
sampa 4y ago
Is there any AppArmor profile for VSCodium that denies it all internet access on Linux? I'm too afraid to run it.
- woojoo666 4y ago
  If you installed it as a flatpak, just use flatseal. And to install new extensions, just download them from open-vsx or the official vscode website, and then drag-drop them into VSCode
azlev 4y ago
- AdmiralAsshat 4y ago
  That stopped being true about ten years ago. Now, you pay for the product, and you are still the product.
  - mixmastamyk 4y ago
    True and True != False
- rstat1 4y ago
  There are soo many exceptions to this phrase that's borderline false.
- Narishma 4y ago
  You are still the product even if you're paying.
lawxls 4y ago
How is PyCharm WSL2 support these days? WSL2 is the biggest reason I switched to VS Code 1 year ago.
- sam_lowry_ 4y ago
  Dunno about PyChsrm, but IntelliJ developers solve WSL2 issues in low-priority mode. I posted a few and followed a few others, resolution time is many months long.
  - colejohnson66 4y ago
    JetBrains just in general treats all issue as low priority. There’s issues open for literal years that they refuse to do anything about. They say “we looked at this issue, and it’s not on our roadmap, so no.” Ok, but what is your roadmap? Why can’t it include a fix for a 5 year old bug? Oh, because you’re working on a replacement that’ll take 3 years to finish. It’s extremely frustrating sometimes.
gonzo41 4y ago
It's a fair price for a free product.
- krono 4y ago
  How can you possibly tell without knowing what exact data is being collected, how it is being used, for how long it will be kept, and where it will end up?
  - gonzo41 4y ago
    I work around and with a climate scientists. What I worry about has changed. Metrics and crash statistics are fine. And if they are collecting some dystopian level of data, then I bet that google and facebook has them beat already.
    - krono 4y ago
      We don't know the true cost of using this application, is what I was trying to say.
djhaskin987 4y ago
It just makes me feel very happy that I use neovim. OSS used in all dev tools is the only way around this problem. Not that I have full OSS in my whole pipeline; I still use GitHub (though I am seriously considering a move to sr.ht).
ctrlmeta 4y ago
I am one of those who began coding in Notepad and then quickly moved on to Vim and then to Emacs. When the whole world of internet services began consolidating around the web and then later when the whole web began consolidating around a few powerful walled gardens, I saw how these trends began chipping away at our anonymity, privacy, web performance and software performance. Computers are ubiquitous but privacy is under attack. Hardware is faster but software is slower. Internet pipes are faster but websites are sluggish. In all this turbulence I thought at least my software development tools are not affected by these terrible user-hostile trends. Emacs has become faster with faster hardware. While Vim was always fast, I am sure the Vim folks too would agree that they can now run Vim with a lot of plugins thanks to faster hardware. These editors do not do hidden telemetry. They don't add user hostile features. The core editor experience remains more or less the same year after year. Even after all the disruption (I mean literally, disruption, not in some positive metaphorical way) in the rest of tech world, I have found consolation in my modest code editor, Emacs for me, Vim for some, other editors for other people. My code editor has always served my best interests. It helps me write code and documentation without any distractions. But when I read articles like this about VSCode and its telemetry, it really makes me anxious. Perhaps Emacs or Vim will never be afflicted by issues like this. But still ... If developer tools meant for ordinary software developers like me are going to start sneaking on my data and begin bundling user-hostile features, what hope is there for all other kind of software tools!
- throwaway22032 4y ago
  Right? It's baffling. I still don't understand why developers use Microsoft tools. At all. About the only valid use case I can think of is creating Windows native apps and _maybe_ testing on IE/Edge. Otherwise, why? Just why would you wade in the shit when there's a lovely clean pool right over there?
  - lunarplague 4y ago
    because Microsoft Shop jobs are well paying, not terribly difficult, and allow people to work on personal projects without burnout.
  - 4y ago
nindalf 4y ago
It's safe to assume Microsoft is GDPR compliant. There's no sense in risking the fines GDPR could potentially levy for the sake of ... what exactly? There's no upside even if this data was somehow de-anonymized. The sensible thing to do is to delete everything within 90 days. Even if the developers behind VS Code didn't agree with that, legal and privacy at MS would make sure they would. All this talk about how this data can be used to target people seems far fetched. Microsoft doesn’t have a serious ads business. What they do have are various products and services to sell to developers - Github and Azure among them. That’s the whole point of VSCode - give it away for free so they can understand developer practices and also upsell paid products. And if anyone doesn’t like that, they can simply … not pay Microsoft any money.
- techsin101 4y ago
  > There is no way to turn this off. What if you added domains to host list
  - nindalf 4y ago
    What if you took a hammer to your WiFi router. Yes, it’s always possible to turn it off but what I meant to say was that the VSCode team makes it hard.
nathanaldensr 4y ago
A warning for people who, like me, long ago disabled telemetry in Visual Studio Code: Microsoft introduced a new setting that deprecates the two older settings... and the new setting defaults to "all"[1]. I just noticed this now after double-checking my settings. Sneaky, sneaky, Microsoft (but still totally expected). [1] https://imgur.com/a/RbrsuyA https://imgur.com/a/RbrsuyA You will want these three settings in your default settings JSON (the first two just to be safe): { "telemetry.enableTelemetry": false, "telemetry.enableCrashReporter": false, "telemetry.telemetryLevel": "off" }
- csmattryder 4y ago
  Ha, vindication. I posted a while back about I used to use OpenSnitch to block VS Code's telemetry requests. One of the comments mentioned that there's already a setting to disable it, ain't that enough..?! I'm once again recommending OpenSnitch: because Microsoft won't take "No" for an answer. https://news.ycombinator.com/item?id=30865152 https://news.ycombinator.com/item?id=30865152
  - RealStickman_ 4y ago
    I'll recommend VS Codium instead of VS Code then. It provides fully open source binaries of VS Code without all the telemetry enabled.
    - Tijdreiziger 4y ago
      https://news.ycombinator.com/item?id=32571867 https://news.ycombinator.com/item?id=32571867
    - JohnFen 4y ago
      TFA says that VS Codium removes as much as it can, but it cannot remove all of the telemetry.
- tjoff 4y ago
  Just as showing ads to people willing to pay to not see ads is supposedly the most lucrative thing humans can envision (not sure how royally pissing off your users is profitable but hey, that's me) it seems that tracking people that don't want to be tracked reveals the most precious data imaginable.
mmebane 4y ago
The extension author docs [1] say that extensions _should_ obey the global setting, even if using their own telemetry libraries: > Extension authors who wish not to use Application Insights can utilize their own custom solution to send telemetry. In this case, it is still required that extension authors respect the user's choice by utilizing the isTelemetryEnabled and onDidChangeTelemetryEnabled API. I suppose the quote in the article is technically correct, because there's no guarantee that _will_ follow this. I'm curious if I could report an extension for abuse and have it removed if it doesn't honor the global setting. The article also says > Microsoft’s C# extension (ms-vscode.csharp) sends data to Microsoft. There does not appear to be any setting offered by the extension to turn telemetry off. I unzipped the extension and looked at the package.json, and it appears to use Microsoft's recommended extension-telemetry library, so I presume it is following the global setting. I wish Microsoft required extensions to publish detailed telemetry info (or, really, info on any and all external connections an extension might make) on their Marketplace page. [1]: https://code.visualstudio.com/api/extension-guides/telemetry https://code.visualstudio.com/api/extension-guides/telemetry
- hajile 4y ago
  I can't take a "maybe it does what it says" to my boss and expect approval to use that extension. It might be different if the license didn't agree to telemetry, but that means they can't even sue if the extension leaks private or secure information. That's a legal minefield.
effnorwood 4y ago
tedmiston 4y ago
> Are there more privacy-focused alternatives to VS Code? Sure, Sublime Text.
- maxlath 4y ago
  VS Codium https://vscodium.com/ https://vscodium.com/
  - ProAm 4y ago
    How often is this updated? I looked at it previously but there were enough caveats/comments to make me weary on using it. I checked the website too but couldnt get (or missed) a definitive answer
    - maxlath 4y ago
      It's updated several times a month https://github.com/VSCodium/vscodium/releases https://github.com/VSCodium/vscodium/releases The biggest caveat would be to be aware of the default connexion to an alternative extension store, https://open-vsx.org https://open-vsx.org, instead of Microsoft's own store, which does not have all the extensions the official store has. But that's less and less an issue, thanks to projects such as https://github.com/open-vsx/publish-extensions https://github.com/open-vsx/publish-extensions. In the worst case, I just manually `git clone`d the desired extension in my local extension folder. Nothing to complain about otherwise
- hitpointdrew 4y ago
  I feel like we are in the minority. I still use, and love, sublime.
pleb_nz 4y ago
What we need, and this may already exist, is away to sanbox apps with the ability to firewall of incoming and outgoing http request. Does this exist? What would be even better was a solution that had profiles for common usages and apps, and the profiles could be created by all and shared via a community or repo and could be extended and tweaked. Does this exist, is it feasible, or does anyone have a better simpler idea?
- treesknees 4y ago
  On MacOS you can use Little Snitch [1] to do exactly this. You can watch all network connections per app, even grab a pcap of traffic just for the app as well. You can setup restrictions to block incoming and outgoing traffic. It basically is a per-app firewall. [1] https://www.obdev.at/products/littlesnitch/index.html https://www.obdev.at/products/littlesnitch/index.html
  - kylehotchkiss 4y ago
    I just came here to ask how Little Snitch can disable these. Do you know which domains are specific for telemetry in VSC?
- woojoo666 4y ago
  On linux if you want to block all network access to an app you can use FlatSeal. It's great for VSCode / VSCodium if you don't want to worry about malicious extensions extraditing your data. To install new extensions, just download them from open-vsx or the official vscode website, and then drag-drop them into VSCode
deleted 4y ago
[deleted]
saghm 4y ago
I just checked, and the only telemetry setting that I have in my VS code config is `"telemetry.telemetryLevel": "off"`. I have the non-free version installed (i.e. not Codium). I installed OpenSnitch and started running it, and it caught a grand total of 7 requests over a few minutes of coding: 2 to marketplace.visualstudio.com (one to port 443 and one to 52), presumably which occurred during startup to check for updates to my extensions, and then 5 to a subdomain of vo.msecnd.net (split across ports 443 and 53). I hadn't heard of this domain before, but from a quick google, I found it listed in the VS Code documentation as their CDN (https://code.visualstudio.com/docs/setup/network https://code.visualstudio.com/docs/setup/network). Overall, this seems...not that crazy? I'm not sure if they just are less egregious on Linux machines or if the CDN is just where they send the analytics to, but it doesn't really seem like much sketchy stuff was happening behind my bacl.
naikrovek 4y ago
the more people complain about telemetry, the more i know I'm right not to be concerned. if it is a problem for you, go back to emacs 19 or vi or whatever and leave the rest of us alone. alternatively, go climb the ladder at any company that collects this terrible scourge of invaluable personal explosive data and get them to stop. I'm ok with this. and just like you didn’t like me belittling your position, as i did above, i’ll kindly ask that you understand my reaction here to being told (without asking, by the way) that telemetry is an unparalleled bad thing. i wish people who are convinced that some illuminati-like cadre is behind all of these things were employed at large companies which could collect this info. there is nowhere nearly enough cohesion between employees to make anything useful out of all the data collected, much less to act upon it, outside of the developers trying to chase the bug that has haunted them for 36 months, and the UX team trying desperately to reduce the amount of choices in menus. i mean, manage a few projects with people who are all on board with the effort - even those groups are hard to keep focused, most of the time. these companies use this data for the stated purposes; to help make their products better. if i could explain some of the technical considerations behind the apparently odd choice of data to collect, it would make a lot more sense, but i’m pretty awful at communicating, and even if i weren’t, and i were able to succinctly convey that info, i feel like most of you would just argue with me anyway.
electric_dreams 4y ago

194 points by ttctciyf 4y ago

throwaway22032 4y ago

It's Microsoft. It's what they do. It's been 20+ years. I'm not even old. I just don't understand how people haven't figured this out yet.

edgyquant 4y ago
Okay but companies don’t just add telemetry because it’s a fun and exciting engineering challenge. They do so for legitimate engineering and business reasons. These solutions have privacy nuance they are not black and white/evil v good
- belter 4y ago
  Enabled by default -> Bad Give user option to enable to improve product -> Good
  - squarefoot 4y ago
    And possibly keep telemetry data (all of it) auditable by users, so that they know exactly what they are opting in to transmit.
    - edgyquant 4y ago
      If you are doing telemetry in a way that respects privacy this won’t be possible. Or at least there won’t be a way to verify whatever data you have locally to their database
  - hajile 4y ago
    Not to mention that if you do anything requiring security, then this all becomes a giant nightmare that results in the entire editor and toolchain being disallowed.
  - edgyquant 4y ago
    This is a political opinion and regardless an implementation detail. My response was that telemetry serves actual purposes and very useful ones at that. Our goal should be to adapt and ensure privacy via regulations and standards. Wishing, or enforcing, that every application not have telemetry by default is both unrealistic and unwanted.
- deleted 4y ago
  [deleted]
- throwaway22032 4y ago
  Telemetry is malware. Always has been.
- falcolas 4y ago
  My concern is that anybody at a company can suggest a telemetry point and it's added with little or no oversight, and store it forever. It may not be a fun engineering challenge (though it could be, depending on the metric), but sifting through the results is a "fun data interpretation" event. Especially for marketing and sales groups. The solutions should have a privacy nuance... but don't. For example from TFA, collecting git branch and repo names. That seems like a terrible idea, since it's not like Microsoft's devs will have access to reproduce issues from those repos. It's also a potential leak of sensitive corporate data.
- npteljes 4y ago
  Factory farming is also an engineering challenge, with legitimate business reasons - its way more economical. I think most of the time horrible things just make sense, in some other framing. My point is - something being useful is a very low bar. It's not the point of the discussion here. Maybe some privacy zealots won't acknowledge this, but telemetry can be very useful, and at the same time a breach of privacy. And regarding Microsoft, it's also about their attitude towards it. It's their way or the highway. It has always been like this - the software might be the way it is, but regarding their business dealings they are and always were ruthless. That's what made them great. So now what we see is a continuation of their previous attitude. And a slice of the current zeitgeist which is always-on internet with everyone slurping up user data.
- squarefoot 4y ago
  Telemetry can be an invaluable source of information to improve products, everyone knows that; it's sorta like having 100% of the users continuously reporting bugs and information from which software vendors can infer most wanted features or modifications to improve usability. Which business wouldn't want that? If done right it could be great for everyone, including users. Unfortunately there's no way to ensure that invaluable tool won't one day be used against users to sneak out data that wouldn't contribute in any way to products improvement, namely making profits from users profiling. But the point isn't being good or evil; businesses have no sense of morals, they don't obey to common sense but rather take the path that leads to the higher profits, and these days profiling users unfortunately brings high profits. It's not a matter of which company is good or bad, or if telemetry can be done right or not, but rather how long until a software with built in telemetry will use it the wrong way, because soon or later everyone of them will be presented the scenario in which doing a bad thing brings them more profits; and this principle applies way beyond telemetry.
declnz 4y ago
IMO it's because they've done very smart pivots / rebranding (VSCode, Github, NPM, even the Surfaces) and people who even know start thinking "new Microsoft"
throwaway642012 4y ago
I'm old enough to remember the browser wars and FUD against linux. It is funny to see MS going from 'M$' to the gatekeeper of OpenSource.
- bitwize 4y ago
  "Developers! Developers! Developers! Developers!" They were losing hearts and minds in the Web dev space by waging war against open source. It makes far more sense to co-opt it, as per the Halloween-document strategy. TBH I saw this coming 20 or so years ago, about the time when IBM started putting on its open-source cheerleader outfit. Open source is formless, shapeless, like water per Bruce Lee. You cannot oppose it with force, it will just get everywhere; but by aligning yourself with it you can direct it. That's what I saw IBM doing and I knew Microsoft would follow suit out of lack of choice. And now here we are.
ajdude 4y ago
I'm a bit surprised at how many of my friends have jumped ship to Visual Studio Code, including those who are very much for free software. They have always been in the business of embrace, extend, extinguish[0]. People tend to forget how evil M$ used to be because recently they have seemed like a beacon for Open Source, but I think they are just still evil[1]. I think we're still dealing with the same Microsoft that we've dealt with through the 90s. They are not a champion of open source, and they are still up to their old tricks.[2] [0] https://news.ycombinator.com/item?id=31966414 https://news.ycombinator.com/item?id=31966414 [1] https://keivan.io/the-day-appget-died/ https://keivan.io/the-day-appget-died/ [2] https://social.platypush.tech/@blacklight/108719097530863121 https://social.platypush.tech/@blacklight/108719097530863121

ttctciyf 4y ago

Found this while looking for a way to fully disable telemetry on vscode. After reading, this seems impossible, short of going down to DNS or network blocks of some kind: the "disable telemetry" setting doesn't; extensions have their own telemetry; MS consider the data sufficiently anonymous to be exempt from GDPR, even the vscodium maintainers say they found it impossible to block vs code's eager telemetrizing. I wonder what is the most effective way of actually completely stopping it phoning home, apart from yanking its ethernet cable?

mayoi 4y ago
You can always simply install a better text editor that doesn't spy on you.
- ttctciyf 4y ago
  Very true. But I have specific reasons for wanting to use vs code in this instance.
- bitwize 4y ago
  What better text editor?
  - katbyte 4y ago
    On windows notepad++ was my goto for basic text editing. These days I use the jetbrains editor of choice for the language in question or IntelliJ for basic text.
  - colordrops 4y ago
    Emacs or *vim
    - gabrielgio 4y ago
      And even if you don't like fiddling with dotfiles you can install some really nice distribution like spacemacs or doom for emacs and lunar for neovim. They have a pleasant dev experience out of the box.

NGRhodes 4y ago

Worth noting that extensions may separately send telemetry, that do not have to adhere to the main VSCode telemetry configuration settings.

gabrielgio 4y ago
What a gross oversight from their part. Not only they build a product that, as pointed by the post, sends a excessive amount of data, but also allows anyone to do the same. > Why have licenses like these if they are just concerned with product improvement? That nails it for me. I have no reason whatsoever to use vscode.
- kroltan 4y ago
  What's the alternative? Blocking extensions from accessing the Internet? How are you even supposed to do that given extensions already have (completely justified) access to the filesystem and can invoke executables? There certainly is a valid argument for Internet access, for example for documentation lookup, schema validation, database editing, etc. There would be a strict, and yet fallible, vetting process on the extension marketplace to make sure every extension complies with whatever rules are defined.
  - gabrielgio 4y ago
    You have a point. There is no way to block access to resources given the nature of the product, but they could, at least, make more effort to create a better community/environment around the tooling (regarding data handling). > extensions may separately send telemetry, that do not have to adhere to the main VSCode telemetry configuration settings. From what I see things that should never happen and should yield a block from the marketplace. Like you mention, in the end of the day that is not enforceable, but more transparent data privacy policy would show some good faith from their side.
  - yjftsjthsd-h 4y ago
    > What's the alternative? Expose the setting to extensions (if it isn't already), and set a policy in their extension catalog that extension telemetry must honor the global setting. It isn't perfect, but it's better than nothing.

whywhywhywhy 4y ago

I honestly wouldn't mind the telemetry but seen as VSCode on Windows will always inevitably completely freeze the entire OS to the point of requiring a restart if you leave it open for long enough, it doesn't give me much faith anyone is looking at it that closely in terms of using it to fix fundamental issues.

nominusllc 4y ago
I have never experienced this, on any OS.
- cassianoleal 4y ago
  From all the anecdotes in this thread, I estimate a 50% chance of it happening.
- whywhywhywhy 4y ago
  It's just Windows and how long are your uptimes and do you leave it open all the time? I know it's not just me because I did find the github issue and there was no fix so I just stopped using VSCode
  - d_tr 4y ago
    I guess you are not referring to some MS extension but to the editor itself, right? I had an issue around a year ago with cpptools on Linux, where a single 80k LOC header would cause obscene memory usage (10+ G) and the extension would basically stop working.

gentleman11 4y ago

Why even make vscode if not for telemetry? It’s the whole point of the app, isn’t it? It’s like chrome or edge or that open source png viewer that started selling your info a few months ago Telemetry is a major focus of windows since the current ceo too over. It’s kind of his thing Note there is an open source version called vscodium that iirc has telemetry disabled but I found my extensions didn’t work with it last year when I tried it

npteljes 4y ago
It's good PR for Microsoft.

Bootvis 4y ago

I think I'm out of the loop: what exactly is so valuable about this telemetry? I don't believe my coding habits can be used for advertising.

api 4y ago
* Profiling what languages you code in * Profiling your work hours * Tracking the physical locations of software professionals * Profiling the nature of the projects you are working on * Perhaps: training GitHub Copilot?
- Bootvis 4y ago
  I get these are huge privacy infringements and I don't like that but except for improving Copilot I don't see how they would make money from that. On the other hand, sites such as StackOverflow and Google (possibly even Bing) can get a good guess of the others as well.
  - rightbyte 4y ago
    MS sale team would probably love to get a grep of all "#include <foo.h>" of a company to see of they can do some sales pitch to eat some vendors lunch.
savanaly 4y ago
FTA: "Visual Studio Code collects telemetry data, which is used to help understand how to improve the product. For example, this usage data helps to debug issues, such as slow start-up times, and to prioritize new features." I don't work at Microsoft but I work somewhere similar on a product that collects similar types of telemetry and those words are not empty, they are very, very true. We absolutely add, remove, and change things about the UI based on what our telemetry says people do. And it's not just about moving things around (which I know HN hates), it's about making the page load faster (which I know HN loves!). We are going through a concerted effort to lower page TTVC at the moment and a big part is going to have to be turning off some features that show by default that take too long to load and guess how we'll be making the call about which features to turn off?

falcolas 4y ago

Telemetry is godsend for developers, since it lets them track down actual product usage and issues. Telemetry is a privacy nightmare for users, since it sends data to the developers outside of an average user's control - data which is probably easily associated with an individual and kept for eons (disk space is cheap after all). I think telemetry collection is starting to become a professional ethics issue for developers, and should be talked about more.

phantomathkg 4y ago
As a developer tool, I think it is absolutely possible for Microsoft and extension developers to write a very deep and detail explanation to the users and explain why do they need to collect what telemetry data. As a user and engineer, I am more than happy to share the usage and crash data with them, but at the same time, I would appreciate if they can be fair to us the user.
- zerkten 4y ago
  They publish research updates like https://www.microsoft.com/en-us/research/group/experimentation-platform-exp/articles/measurably-improve-your-product-by-combining-qualitative-and-quantitative-methods/ https://www.microsoft.com/en-us/research/group/experimentati....
bentcorner 4y ago
What do you think about regulation like the GDPR?
- falcolas 4y ago
  I like them. I don't really understand how it would apply to telemetry - it's not something I've read into - and I don't think many other folks are looking into GDPR compliance with telemetry either.
  - zerkten 4y ago
    All of the big companies have armies of lawyers deeply familiar with these laws and regulations. They make their engineering teams implement processes to mitigate the issues with storage and processing. Examples: replacing/removing external IDs, ensuring data can't be linked to users, aggregating data, not retaining data, only processing data within data centers (no data extracted to laptops), deleting old data, etc. This is why it's slow and painful to work at big companies compared to startups. It doesn't mean that accidents don't happen, but it's pretty well thought out. The same applies to how they do qualitative research. It's got reasonably high standards which are fairly consistently applied. It's not perfect, but nothing is. There is a lot of job security and motivation for people to make it better. Smaller companies have almost zero understanding of how to deal with this due to lack of resources and expertise. The only way they get compliant is by using good tools which force the user into a safer, more compliant posture.

Lio 4y ago

The TL;DR is Microsoft won't tell you what they collect and ignore settings that limit telemetry. If you use VSCode or its extensions you can't keep commercial secrets from those working at Microsoft unless you block network traffic from VSCode. This seems to be true even in the open source builds like VSCodium.

webmobdev 4y ago
> This seems to be true even in the open source builds like VSCodium. Which is ironical given that you should be able to completely strip any telemetry code if the complete source is available ...
rstat1 4y ago
So I guess this page on their website is fiction? https://code.visualstudio.com/docs/getstarted/telemetry https://code.visualstudio.com/docs/getstarted/telemetry
- pseudalopex 4y ago
  The article went into detail about it.
  - jsmith45 4y ago
    Except the article does not. If you turn off telemetry and crash reporting, then there is no telemetry. (Except possibly the telemetry from plugins that choose not to honor the telemetry toggle). This post provides no examples of telemetry being sent when the option is turned off. Now the program does have a variety of spots where it is designed to contact Microsoft services, like say the extension store, or update checks, or other similar functionality. Those services will (obviously) keep some level of logging data, which you cannnot opt out of if VSCode Talks to those services. This is what the terms are talking about when they indicate that not all collected data can be opted out of. There is no "Don't talk to any Microsoft cloud service" feature toggle, sure, but would not really be a sane toggle people actually want. For example that toggle would need to forcibly disable the git support to ensure those features don't try to talk to GitHub if you open code in some GitHub checked out repo. It would disable the extensions store. It would prevent the update checking, etc. VSCodium would end up wanting to rip chunks of that toggle's functionality back out, since for example, VSCodium uses a different non-Microsoft extension store by default, so would want want the extension store to remain disabled.

jacknews 4y ago

There's always vscodium which which doesn't have the tracking, similar to Chromium browser vs Chrome: https://vscodium.com/ https://vscodium.com/

phantomathkg 4y ago
As the post mentioned, even the VSCodium team cannot shutdown all telemetry. Seems some do not have switches?
- jacknews 4y ago
  You are correct, I didn't read the whole thing completely.
- ensignavenger 4y ago
  Why not just remove it from the source code?
  - 5d8767c68926 4y ago
    Given the frequency of updates, maintaining a privacy fork with anything but minor changes would be a Sisyphean task.
    - npteljes 4y ago
      Which is exactly what I'd expect from a privacy fork.
      - phantomathkg 4y ago
        How about we contribute back the changes needed?
        npteljes 4y ago
        You mean, you and I should team up for some quality free software work?

sampa 4y ago

Is there any AppArmor profile for VSCodium that denies it all internet access on Linux? I'm too afraid to run it.

woojoo666 4y ago
If you installed it as a flatpak, just use flatseal. And to install new extensions, just download them from open-vsx or the official vscode website, and then drag-drop them into VSCode

azlev 4y ago

AdmiralAsshat 4y ago
That stopped being true about ten years ago. Now, you pay for the product, and you are still the product.
- mixmastamyk 4y ago
  True and True != False
rstat1 4y ago
There are soo many exceptions to this phrase that's borderline false.
Narishma 4y ago
You are still the product even if you're paying.

lawxls 4y ago

How is PyCharm WSL2 support these days? WSL2 is the biggest reason I switched to VS Code 1 year ago.

sam_lowry_ 4y ago
Dunno about PyChsrm, but IntelliJ developers solve WSL2 issues in low-priority mode. I posted a few and followed a few others, resolution time is many months long.
- colejohnson66 4y ago
  JetBrains just in general treats all issue as low priority. There’s issues open for literal years that they refuse to do anything about. They say “we looked at this issue, and it’s not on our roadmap, so no.” Ok, but what is your roadmap? Why can’t it include a fix for a 5 year old bug? Oh, because you’re working on a replacement that’ll take 3 years to finish. It’s extremely frustrating sometimes.

gonzo41 4y ago

It's a fair price for a free product.

krono 4y ago
How can you possibly tell without knowing what exact data is being collected, how it is being used, for how long it will be kept, and where it will end up?
- gonzo41 4y ago
  I work around and with a climate scientists. What I worry about has changed. Metrics and crash statistics are fine. And if they are collecting some dystopian level of data, then I bet that google and facebook has them beat already.
  - krono 4y ago
    We don't know the true cost of using this application, is what I was trying to say.

djhaskin987 4y ago

It just makes me feel very happy that I use neovim. OSS used in all dev tools is the only way around this problem. Not that I have full OSS in my whole pipeline; I still use GitHub (though I am seriously considering a move to sr.ht).

ctrlmeta 4y ago

I am one of those who began coding in Notepad and then quickly moved on to Vim and then to Emacs. When the whole world of internet services began consolidating around the web and then later when the whole web began consolidating around a few powerful walled gardens, I saw how these trends began chipping away at our anonymity, privacy, web performance and software performance. Computers are ubiquitous but privacy is under attack. Hardware is faster but software is slower. Internet pipes are faster but websites are sluggish. In all this turbulence I thought at least my software development tools are not affected by these terrible user-hostile trends. Emacs has become faster with faster hardware. While Vim was always fast, I am sure the Vim folks too would agree that they can now run Vim with a lot of plugins thanks to faster hardware. These editors do not do hidden telemetry. They don't add user hostile features. The core editor experience remains more or less the same year after year. Even after all the disruption (I mean literally, disruption, not in some positive metaphorical way) in the rest of tech world, I have found consolation in my modest code editor, Emacs for me, Vim for some, other editors for other people. My code editor has always served my best interests. It helps me write code and documentation without any distractions. But when I read articles like this about VSCode and its telemetry, it really makes me anxious. Perhaps Emacs or Vim will never be afflicted by issues like this. But still ... If developer tools meant for ordinary software developers like me are going to start sneaking on my data and begin bundling user-hostile features, what hope is there for all other kind of software tools!

throwaway22032 4y ago
Right? It's baffling. I still don't understand why developers use Microsoft tools. At all. About the only valid use case I can think of is creating Windows native apps and _maybe_ testing on IE/Edge. Otherwise, why? Just why would you wade in the shit when there's a lovely clean pool right over there?
- lunarplague 4y ago
  because Microsoft Shop jobs are well paying, not terribly difficult, and allow people to work on personal projects without burnout.
- 4y ago

nindalf 4y ago

It's safe to assume Microsoft is GDPR compliant. There's no sense in risking the fines GDPR could potentially levy for the sake of ... what exactly? There's no upside even if this data was somehow de-anonymized. The sensible thing to do is to delete everything within 90 days. Even if the developers behind VS Code didn't agree with that, legal and privacy at MS would make sure they would. All this talk about how this data can be used to target people seems far fetched. Microsoft doesn’t have a serious ads business. What they do have are various products and services to sell to developers - Github and Azure among them. That’s the whole point of VSCode - give it away for free so they can understand developer practices and also upsell paid products. And if anyone doesn’t like that, they can simply … not pay Microsoft any money.

techsin101 4y ago
> There is no way to turn this off. What if you added domains to host list
- nindalf 4y ago
  What if you took a hammer to your WiFi router. Yes, it’s always possible to turn it off but what I meant to say was that the VSCode team makes it hard.

nathanaldensr 4y ago

A warning for people who, like me, long ago disabled telemetry in Visual Studio Code: Microsoft introduced a new setting that deprecates the two older settings... and the new setting defaults to "all"[1]. I just noticed this now after double-checking my settings. Sneaky, sneaky, Microsoft (but still totally expected). [1] https://imgur.com/a/RbrsuyA https://imgur.com/a/RbrsuyA You will want these three settings in your default settings JSON (the first two just to be safe): { "telemetry.enableTelemetry": false, "telemetry.enableCrashReporter": false, "telemetry.telemetryLevel": "off" }

csmattryder 4y ago
Ha, vindication. I posted a while back about I used to use OpenSnitch to block VS Code's telemetry requests. One of the comments mentioned that there's already a setting to disable it, ain't that enough..?! I'm once again recommending OpenSnitch: because Microsoft won't take "No" for an answer. https://news.ycombinator.com/item?id=30865152 https://news.ycombinator.com/item?id=30865152
- RealStickman_ 4y ago
  I'll recommend VS Codium instead of VS Code then. It provides fully open source binaries of VS Code without all the telemetry enabled.
  - Tijdreiziger 4y ago
    https://news.ycombinator.com/item?id=32571867 https://news.ycombinator.com/item?id=32571867
  - JohnFen 4y ago
    TFA says that VS Codium removes as much as it can, but it cannot remove all of the telemetry.
tjoff 4y ago
Just as showing ads to people willing to pay to not see ads is supposedly the most lucrative thing humans can envision (not sure how royally pissing off your users is profitable but hey, that's me) it seems that tracking people that don't want to be tracked reveals the most precious data imaginable.

mmebane 4y ago

The extension author docs [1] say that extensions _should_ obey the global setting, even if using their own telemetry libraries: > Extension authors who wish not to use Application Insights can utilize their own custom solution to send telemetry. In this case, it is still required that extension authors respect the user's choice by utilizing the isTelemetryEnabled and onDidChangeTelemetryEnabled API. I suppose the quote in the article is technically correct, because there's no guarantee that _will_ follow this. I'm curious if I could report an extension for abuse and have it removed if it doesn't honor the global setting. The article also says > Microsoft’s C# extension (ms-vscode.csharp) sends data to Microsoft. There does not appear to be any setting offered by the extension to turn telemetry off. I unzipped the extension and looked at the package.json, and it appears to use Microsoft's recommended extension-telemetry library, so I presume it is following the global setting. I wish Microsoft required extensions to publish detailed telemetry info (or, really, info on any and all external connections an extension might make) on their Marketplace page. [1]: https://code.visualstudio.com/api/extension-guides/telemetry https://code.visualstudio.com/api/extension-guides/telemetry

hajile 4y ago
I can't take a "maybe it does what it says" to my boss and expect approval to use that extension. It might be different if the license didn't agree to telemetry, but that means they can't even sue if the extension leaks private or secure information. That's a legal minefield.

effnorwood 4y ago

tedmiston 4y ago

> Are there more privacy-focused alternatives to VS Code? Sure, Sublime Text.

maxlath 4y ago
VS Codium https://vscodium.com/ https://vscodium.com/
- ProAm 4y ago
  How often is this updated? I looked at it previously but there were enough caveats/comments to make me weary on using it. I checked the website too but couldnt get (or missed) a definitive answer
  - maxlath 4y ago
    It's updated several times a month https://github.com/VSCodium/vscodium/releases https://github.com/VSCodium/vscodium/releases The biggest caveat would be to be aware of the default connexion to an alternative extension store, https://open-vsx.org https://open-vsx.org, instead of Microsoft's own store, which does not have all the extensions the official store has. But that's less and less an issue, thanks to projects such as https://github.com/open-vsx/publish-extensions https://github.com/open-vsx/publish-extensions. In the worst case, I just manually `git clone`d the desired extension in my local extension folder. Nothing to complain about otherwise
hitpointdrew 4y ago
I feel like we are in the minority. I still use, and love, sublime.

pleb_nz 4y ago

What we need, and this may already exist, is away to sanbox apps with the ability to firewall of incoming and outgoing http request. Does this exist? What would be even better was a solution that had profiles for common usages and apps, and the profiles could be created by all and shared via a community or repo and could be extended and tweaked. Does this exist, is it feasible, or does anyone have a better simpler idea?

treesknees 4y ago
On MacOS you can use Little Snitch [1] to do exactly this. You can watch all network connections per app, even grab a pcap of traffic just for the app as well. You can setup restrictions to block incoming and outgoing traffic. It basically is a per-app firewall. [1] https://www.obdev.at/products/littlesnitch/index.html https://www.obdev.at/products/littlesnitch/index.html
- kylehotchkiss 4y ago
  I just came here to ask how Little Snitch can disable these. Do you know which domains are specific for telemetry in VSC?
woojoo666 4y ago
On linux if you want to block all network access to an app you can use FlatSeal. It's great for VSCode / VSCodium if you don't want to worry about malicious extensions extraditing your data. To install new extensions, just download them from open-vsx or the official vscode website, and then drag-drop them into VSCode

deleted 4y ago

[deleted]

saghm 4y ago

I just checked, and the only telemetry setting that I have in my VS code config is `"telemetry.telemetryLevel": "off"`. I have the non-free version installed (i.e. not Codium). I installed OpenSnitch and started running it, and it caught a grand total of 7 requests over a few minutes of coding: 2 to marketplace.visualstudio.com (one to port 443 and one to 52), presumably which occurred during startup to check for updates to my extensions, and then 5 to a subdomain of vo.msecnd.net (split across ports 443 and 53). I hadn't heard of this domain before, but from a quick google, I found it listed in the VS Code documentation as their CDN (https://code.visualstudio.com/docs/setup/network https://code.visualstudio.com/docs/setup/network). Overall, this seems...not that crazy? I'm not sure if they just are less egregious on Linux machines or if the CDN is just where they send the analytics to, but it doesn't really seem like much sketchy stuff was happening behind my bacl.

naikrovek 4y ago

the more people complain about telemetry, the more i know I'm right not to be concerned. if it is a problem for you, go back to emacs 19 or vi or whatever and leave the rest of us alone. alternatively, go climb the ladder at any company that collects this terrible scourge of invaluable personal explosive data and get them to stop. I'm ok with this. and just like you didn’t like me belittling your position, as i did above, i’ll kindly ask that you understand my reaction here to being told (without asking, by the way) that telemetry is an unparalleled bad thing. i wish people who are convinced that some illuminati-like cadre is behind all of these things were employed at large companies which could collect this info. there is nowhere nearly enough cohesion between employees to make anything useful out of all the data collected, much less to act upon it, outside of the developers trying to chase the bug that has haunted them for 36 months, and the UX team trying desperately to reduce the amount of choices in menus. i mean, manage a few projects with people who are all on board with the effort - even those groups are hard to keep focused, most of the time. these companies use this data for the stated purposes; to help make their products better. if i could explain some of the technical considerations behind the apparently odd choice of data to collect, it would make a lot more sense, but i’m pretty awful at communicating, and even if i weren’t, and i were able to succinctly convey that info, i feel like most of you would just argue with me anyway.

electric_dreams 4y ago