3 ms·

I had to use VS Code it briefly for a class, and was kind of shocked by the telemetry stuff, and that it's just ignore-accepted by both the students and the ins

I had to use VS Code it briefly for a class, and was kind of shocked by the telemetry stuff, and that it's just ignore-accepted by both the students and the instructors. But what turned me off more was this janky feeling around the whole application, something I don't remember experiencing in many other Microsoft tools, such as VB. It feels like it was designed from the code up rather than from the interface down, and everything I do feels like I'm accommodating the program rather than the other way around. Anyway, the author of this article was right, I still did have it installed in my dev environment, left behind from those classes. I decided to use this opportunity to `pacman --remove code`. The situation with bad application behaviors being "baked into the code" and propagating to all the "free" distributions is very sad, similar to what's happening with both Chrome and Firefox. For example, HSTS is now baked into the all the standard distributions and there's absolutely no way (that I've found) to turn it off. I understand the "security" reasons behind it for regular users, but as someone mindful and often completely unable to access a website only because their certificate has expired, I am quite miffed.

input_sh 4y ago
FYI you can get around HSTS errors on Chromium-based browsers by typing thisisunsafe. Source: https://chromium.googlesource.com/chromium/src/+/d8fc089b62cd4f8d907acff6fb3f5ff58f168697 https://chromium.googlesource.com/chromium/src/+/d8fc089b62c...
- d_k_f 4y ago
  Additionally, you can remove stored HSTS states using Chrome's chrome://net-internals configuration page.
  - forgotmypw17 4y ago
    Not anymore: >The net-internals events viewer and related functionality has been removed. Please use chrome://net-export to save netlogs and the external netlog_viewer to view them.
    - d_k_f 4y ago
      Interesting (and sad), thanks for the correction. I was using "Kiwi Browser" on mobile to ensure I had the right address, which is a Chrome fork that allows extensions (I think they're forking Chrome instead of "just" Chromium since it looks and feels like regular Chrome otherwise). In here, I still have it available. Might be high time to check for something similar on the desktop.
- kbelder 4y ago
  Doesn't that page indicate something else? /** * This allows errors to be skippped by typing a secret phrase into the page. * @param {string} e The key that was just pressed. */ function handleKeypress(e) { // HTTPS errors are serious and should not be ignored. For testing purposes, // other approaches are both safer and have fewer side-effects. // See https://goo.gl/ZcZixP for more details. var BYPASS_SEQUENCE = window.atob('dGhpc2lzdW5zYWZl'); if (BYPASS_SEQUENCE.charCodeAt(keyPressState) == e.keyCode) { keyPressState++; if (keyPressState == BYPASS_SEQUENCE.length) { sendCommand(SecurityInterstitialCommandId.CMD_PROCEED); keyPressState = 0; } } else { keyPressState = 0; } }
  - wlonkly 4y ago
    window.atob('dGhpc2lzdW5zYWZl'); evaluates to thisisunsafe
eyelidlessness 4y ago
> The situation with bad application behaviors being "baked into the code" and propagating to all the "free" distributions is very sad, similar to what's happening with both Chrome and Firefox. > For example, HSTS is now baked into the all the standard distributions and there's absolutely no way (that I've found) to turn it off. I understand the "security" reasons behind it for regular users, but as someone mindful and often completely unable to access a website only because their certificate has expired, I am quite miffed. I triple checked because I wanted to be absolutely sure: HSTS is a response header (Strict-Transport-Security) sent by the server. It is expressed as the intent of the website you’re trying to visit that it shouldn’t be accessed insecurely. The “bad application behavior” is honoring the site’s express intent and the standard, voluntarily adopted by the server you’re trying to access. You’re certainly welcome to use or write your own HTTP client which ignores the intent of resources you want to access. You’re just as welcome to write your own browser which ignores CORS and all manner of other client/user protections. It’s baffling that you feel entitled to have people do that work for you. Particularly because nearly all of the work already has been done for you, and you’re still miffed because they didn’t cater to your preferences in the exact way you want.
- zzo38computer 4y ago
  They aren't the only one; many people have similar opinions (including myself), that it should do what the end user specifies instead of what the server specifies. Better web browsers will need to be written, and it isn't so simple to do. (I have some ideas about it, though.) (You are right that HSTS is a response header, but I think that it is a bad idea. Even though I have a old version of Firefox, I had to edit one of the files to make it unable to recognize that response header, and change many other things.)
  - eyelidlessness 4y ago
    > Even though I have a old version of Firefox, I had to edit one of the files to make it unable to recognize that response header, and change many other things. You can edit newer versions too. It’s fully open source, the world is your insecure oyster! > You are right that HSTS is a response header, but I think that it is a bad idea. Fortunately for both of us, I can enjoy the good idea and you can enjoy exposing yourself to potentially compromised websites! Hopefully no one is harmed.
pjmlp 4y ago
The same students and the instructors that usually used Chromebooks?
jerome-jh 4y ago
Could we say that "virality" is reversed with the MIT license compared to the GPL? With the MIT license, additional license agreements can hamper the distribution of the source code or make it useless to the user. Examples: Android AOSP and the Google services, VS code (this article). To the contrary the open-sourced code is still useful to its owner: reputation, occasional free bug-fixes. In the end the MIT license is used by corporations to gain market-shares and sell proprietary SW, hence the reversed virality.
- cryptonector 4y ago
  GPL also allows additional license agreements. This is not a fault of the MIT license. You have to understand the totality of the licensing on some piece of open source to understand the implications. > In the end the MIT license is used by corporations to gain market-shares and sell proprietary SW, hence the reversed virality. Permissively-licensed open source is often used in proprietary products, yes. So what? Often the author(s) of the open source version don't mind and/or want that to be possible -- it's a perfectly legitimate choice for them to make. There seems to be a very judgmental vein in GPL fan thinking that authors who choose permissive licenses are at fault for not all open source being copyleft, and that those authors are "bad". The choice of license is always a "business" decision, even when it's made by an individual acting on their own behalf and not a corporation's!

input_sh 4y ago

FYI you can get around HSTS errors on Chromium-based browsers by typing thisisunsafe. Source: https://chromium.googlesource.com/chromium/src/+/d8fc089b62cd4f8d907acff6fb3f5ff58f168697 https://chromium.googlesource.com/chromium/src/+/d8fc089b62c...

d_k_f 4y ago
Additionally, you can remove stored HSTS states using Chrome's chrome://net-internals configuration page.
- forgotmypw17 4y ago
  Not anymore: >The net-internals events viewer and related functionality has been removed. Please use chrome://net-export to save netlogs and the external netlog_viewer to view them.
  - d_k_f 4y ago
    Interesting (and sad), thanks for the correction. I was using "Kiwi Browser" on mobile to ensure I had the right address, which is a Chrome fork that allows extensions (I think they're forking Chrome instead of "just" Chromium since it looks and feels like regular Chrome otherwise). In here, I still have it available. Might be high time to check for something similar on the desktop.
kbelder 4y ago
Doesn't that page indicate something else? /** * This allows errors to be skippped by typing a secret phrase into the page. * @param {string} e The key that was just pressed. */ function handleKeypress(e) { // HTTPS errors are serious and should not be ignored. For testing purposes, // other approaches are both safer and have fewer side-effects. // See https://goo.gl/ZcZixP for more details. var BYPASS_SEQUENCE = window.atob('dGhpc2lzdW5zYWZl'); if (BYPASS_SEQUENCE.charCodeAt(keyPressState) == e.keyCode) { keyPressState++; if (keyPressState == BYPASS_SEQUENCE.length) { sendCommand(SecurityInterstitialCommandId.CMD_PROCEED); keyPressState = 0; } } else { keyPressState = 0; } }
- wlonkly 4y ago
  window.atob('dGhpc2lzdW5zYWZl'); evaluates to thisisunsafe

eyelidlessness 4y ago

> The situation with bad application behaviors being "baked into the code" and propagating to all the "free" distributions is very sad, similar to what's happening with both Chrome and Firefox. > For example, HSTS is now baked into the all the standard distributions and there's absolutely no way (that I've found) to turn it off. I understand the "security" reasons behind it for regular users, but as someone mindful and often completely unable to access a website only because their certificate has expired, I am quite miffed. I triple checked because I wanted to be absolutely sure: HSTS is a response header (Strict-Transport-Security) sent by the server. It is expressed as the intent of the website you’re trying to visit that it shouldn’t be accessed insecurely. The “bad application behavior” is honoring the site’s express intent and the standard, voluntarily adopted by the server you’re trying to access. You’re certainly welcome to use or write your own HTTP client which ignores the intent of resources you want to access. You’re just as welcome to write your own browser which ignores CORS and all manner of other client/user protections. It’s baffling that you feel entitled to have people do that work for you. Particularly because nearly all of the work already has been done for you, and you’re still miffed because they didn’t cater to your preferences in the exact way you want.

zzo38computer 4y ago
They aren't the only one; many people have similar opinions (including myself), that it should do what the end user specifies instead of what the server specifies. Better web browsers will need to be written, and it isn't so simple to do. (I have some ideas about it, though.) (You are right that HSTS is a response header, but I think that it is a bad idea. Even though I have a old version of Firefox, I had to edit one of the files to make it unable to recognize that response header, and change many other things.)
- eyelidlessness 4y ago
  > Even though I have a old version of Firefox, I had to edit one of the files to make it unable to recognize that response header, and change many other things. You can edit newer versions too. It’s fully open source, the world is your insecure oyster! > You are right that HSTS is a response header, but I think that it is a bad idea. Fortunately for both of us, I can enjoy the good idea and you can enjoy exposing yourself to potentially compromised websites! Hopefully no one is harmed.

pjmlp 4y ago

The same students and the instructors that usually used Chromebooks?

jerome-jh 4y ago

Could we say that "virality" is reversed with the MIT license compared to the GPL? With the MIT license, additional license agreements can hamper the distribution of the source code or make it useless to the user. Examples: Android AOSP and the Google services, VS code (this article). To the contrary the open-sourced code is still useful to its owner: reputation, occasional free bug-fixes. In the end the MIT license is used by corporations to gain market-shares and sell proprietary SW, hence the reversed virality.

cryptonector 4y ago
GPL also allows additional license agreements. This is not a fault of the MIT license. You have to understand the totality of the licensing on some piece of open source to understand the implications. > In the end the MIT license is used by corporations to gain market-shares and sell proprietary SW, hence the reversed virality. Permissively-licensed open source is often used in proprietary products, yes. So what? Often the author(s) of the open source version don't mind and/or want that to be possible -- it's a perfectly legitimate choice for them to make. There seems to be a very judgmental vein in GPL fan thinking that authors who choose permissive licenses are at fault for not all open source being copyleft, and that those authors are "bad". The choice of license is always a "business" decision, even when it's made by an individual acting on their own behalf and not a corporation's!