10 ms·

VSCode is an IDE designed to suffocate the open source alternatives, so that they retain full strategic control. Oh, and it also promotes their tech (Copilot, G

VSCode is an IDE designed to suffocate the open source alternatives, so that they retain full strategic control. Oh, and it also promotes their tech (Copilot, Github, C#, TypeScript). It's a long list of issues. It works well though, particularly over SSH and devcontainers, although it has severe bugs that they refuse to fix, and it isn't open source so you can't fix it yourself. I wish software was secure by design, like browsers are. But it just isn't a business priority, because consumers have so little to lose. And enterprise customers have strict environments, separate staging/production environments that reduce blast radius, and so on, so the insecurity is tolerable. Besides, employees can't be trusted anyway, so what's the point of having a very secure IDE if they immediately run curl|sudo bash. Are there any good web-based alternatives? (like Runpod's openvscode-server)

jeffbee 2y ago
Eclipse theia. It is an almost pixel-perfect ripoff of VS Code that integrates the open source components such as Monaco. It is what you are using if you've ever started a Google Cloud Shell Editor.
- TiredOfLife 2y ago
  Theia embraced the Monaco editor. Are extending it and now are trying to extinguish VS Code.
- brabel 2y ago
  Amazing that most commenters seem to even be unaware of Eclipse Theia which is basically THE open-source VSCode. They need better marketing (well, being open-source, they'll never have great marketing like MSFT, of course).
  - exceptione 2y ago
    I would add: ...and being Eclipse they will have no marketing at all. Eclipse offers tons of interesting IDE's, languages ranging from C, Java, PHP, there used to be Haskell support as well. Granted, not every language has the same depth of features, and some plugins are practically abandoned. There are tools for the automotive industry, tools for building Dsl's and IDEs, hardware programming, the list goes on. Eclipse is built as an IDE, but also as a platform to build your own IDE. I think that DBeaver is also based on Eclipse-the-platform. But eclipse also reinforces memes, look at eclipse.org - Software from the US: Great marketing, invasive, beginner friendly, attention to UX, great design, steals your data by default. - Software from the EU: Deeply buried on a 2007 website, great feature depth, interface tailored to power users, designers have been killed, community equals you + 20 experts on some mailing list, no data sharing or only as opt-in (they are just memes, with a pinch of truth)
- PeterStuer 2y ago
  After decades of using IDE's from Think Pascal/C, MCL, Borland C++/JBuilder and lots of Visual Studio and mostly PyCharm these days, I was forced to use an Eclipse IDE for a model driven dev project a few years ago. Worst IDE experience ever and this tainted the 'Eclipse' brand for me forever.
hedora 2y ago
Vscodium is open source, and ssh mode works. I don’t think copilot does.
- evilduck 2y ago
  Cline, Roo, and Continue all work with Codium though, so it's not a big loss.
- Arrowmaster 2y ago
  Since when? Last time I looked the remote ssh plugin wasn't open source and refused to run on forks?
  - hedora 2y ago
    There is an open source reimplementation (or two?) I thought I used this one: https://github.com/xaberus/vscode-remote-oss https://github.com/xaberus/vscode-remote-oss and everything just worked, though the directions on that page look complicated, so it might be the wrong project. It was in the store that ships with the open source build and was definitely open source.
- kristopolous 2y ago
  this looks like the chromium version of vscode, so long as we're both talking about the same thing: https://vscodium.com/ https://vscodium.com/
goldencoralefan 2y ago
Zed. It is written in a compiled language and it’s C++ extension doesn’t take down my servers.
- jay_kyburz 2y ago
  Ohh, interesting to see they have Linux builds available now.
- o11c 2y ago
  Zed was in the news recently for the exact same security flaw.
bongodongobob 2y ago
VSCode is great. If it suffocates other products, that's their fault for not being better. MS hate for hate sake is fucking old, do better.
- KronisLV 2y ago
  I don’t think people like the principle behind it: https://en.m.wikipedia.org/wiki/Embrace,_extend,_and_extinguish https://en.m.wikipedia.org/wiki/Embrace,_extend,_and_extingu... Same reason why some people are adamantly against using closed source software though at least https://github.com/VSCodium/vscodium https://github.com/VSCodium/vscodium exists. That said, personally I use OSes like Windows or IDEs like JetBrains sometimes just because they help me get things done, it is what it is.
  - kristiandupont 2y ago
    Other companies don't say EEE (MS also doesn't anymore, as far as I know), but that doesn't mean they are any better. In fact, I would say that Apple is far more guilty of doing this than MS is these days. But even so, what is the alternative? If MS creates any good product, people will accuse them of being at some phase in EEE, which is unfalsifiable.
    - KronisLV 2y ago
      I guess the alternative would be for MS to make this great product fully FOSS, so that there wouldn’t be a problem in the first place. But ofc that isn’t realistic for a plethora of reasons. Also not saying that MS is somehow unique or worse than Apple, or Google or whatever, they each have their good and bad bits.
    - andy81 2y ago
      It's Microsoft's actions which lose them trust, regardless of what they might state in official communications. Actions like the C# dev kit license footgun/rug pull, the closed source remote development extensions, and training copilot on GPL while pretending that you own any code it generates. You don't need even need a rant on the Windows team, it would be beating a dead horse.
csdreamer7 2y ago
> VSCode is an IDE designed to suffocate the open source alternatives, so that they retain full strategic control What open source alternatives? Atom was a mess that kept breaking. LSP plugins are now used in almost every featureful editor and have really made editing a lot better. You spent more time configuring Vim and Emacs than they saved you. Microsoft made a really good code editor that set a standard and likely took market share from their own (mostly Windows) Visual Studio. I do not use it anymore because of the creep of closed source plugins (+ they keep breaking my workflow) but I still think it is a great improvement. > I wish software was secure by design, like browsers are. Someone does not remember (or was not around) for the ActiveX or Flash days.
- skydhash 2y ago
  > You spent more time configuring Vim and Emacs than they saved you I trade whatever default workflow that VSCode and other IDEs are imposing for a better editing experience. And even the initial time investment is short these days due to the trove of config and tutorials online. After learning Vim, I ditched the files explorer and embrace the buffer workflow instead. Opening many windows at the same time to peek at multiple files, then switching to a new tab only if I don’t want to lose the current windows configuration. Then fuzzy searching for navigation, and using the quickfix list for search and errors. No friction from thought to action. Another plus for me. I have an emacs session opened for weeks now inside a VM on my desktop to work on a side project. Whatever the computer (laptops or said desktopj, it’s a quick ssh, then resuming the dtach sessiom and my workspace is ready. Multiple files opened (almost all of them), a postgresql REPL, Tasks runners, and a lot of packages (magit, project.el, consult,…) working together to streamline working on code.
  - eru 2y ago
    > I trade whatever default workflow that VSCode and other IDEs are imposing for a better editing experience. And even the initial time investment is short these days due to the trove of config and tutorials online. You can configure VSCode with plugins. They aren't imposing any more defaults than vim or emacs do.
m463 2y ago
> I wish software was secure by design, like browsers are. I feel this is one of those "repeat it until it is true" marketing things, like "apple believes privacy is a fundamental right" But really, I think vscode, browsers and apple products only tangentially secure because business goals, features and convenience trump these kinds of broad statements. I so wish it was otherwise. There are so few islands of common sense in our world and the water level keeps rising.
- white-flame 2y ago
  I think it's more a case that browsers take security into account at the feature design phase, whereas other applications don't. That's actually a huge step in the right direction. Same thing with mobile OSes, which have a very preferable decision to sandbox individual applications, instead of running them with full user permissions & full user data access, like desktop OSes do. Now, whether the browsers or mobile OSes actually are secure because of that, is a separate thing, but those are good steps to take.
  - idle_zealot 2y ago
    > which have a very preferable decision to sandbox individual applications, instead of running them with full user permissions It's great that they took security into account during the design phase. I wish they had also taken into account user empowerment. They sandboxed all the apps and in so doing made interoperation, plugins, patches, mods, etc basically impossible. Now the most widely-used form of personal computer is more like a portal to digital services than it is a computing platform. It's sad to see, and I refuse to believe that it's one-or-the-other when it comes to security vs power.
  - worthless-trash 2y ago
    > I think it's more a case that > browsers take security into > account at the feature design > phase. I think that many software people do this. It's likely that you are more familiar with a browsers development cycle.
- curt15 2y ago
otabdeveloper4 2y ago
> what's the point of having a very secure IDE if they immediately run curl|sudo bash Docker is a technology that downloads random unsigned tarballs from the Internet and runs them as root. Also it turns off your system firewall in the process, to make all this more "convenient". Really we have much more low-hanging fruit to pick.
- KronisLV 2y ago
  They’re working on signing: https://docs.docker.com/engine/security/trust/ https://docs.docker.com/engine/security/trust/ They have a rootless mode: https://docs.docker.com/engine/security/rootless/ https://docs.docker.com/engine/security/rootless/ Firewall situation is mixed: https://docs.docker.com/engine/network/packet-filtering-firewalls/#integration-with-firewalld https://docs.docker.com/engine/network/packet-filtering-fire... It’s a bummer that those aren’t the defaults, but it would directly make things less convenient and therefore make people less likely to use it (same reason why installing various software is still offered as a Bash script that you curl and pipe to your terminal, e.g. Ollama; at least it’s not offered as the only way usually), what a world.
- Sophira 2y ago
  This is pretty much exactly why I've never used Docker up to now, as cool as it seems.
kristopolous 2y ago
"Runpod's openvscode-server" I searched, couldn't find it. what are you talking about?
- kirici 2y ago
  I'd guess that there was a mixup: https://github.com/gitpod-io/openvscode-server https://github.com/gitpod-io/openvscode-server For what it's worth, we have been using code-server instead in prod (prod being internal) for over a year now. https://github.com/coder/code-server https://github.com/coder/code-server https://coder.com/docs/code-server/FAQ#whats-the-difference-between-code-server-and-openvscode-server https://coder.com/docs/code-server/FAQ#whats-the-difference-...
  - concerndc1tizen 2y ago
    How would you compare the three options, - https://github.com/gitpod-io/openvscode-server https://github.com/gitpod-io/openvscode-server - https://github.com/coder/code-server https://github.com/coder/code-server - https://github.com/eclipse-theia/theia https://github.com/eclipse-theia/theia I'm not sure if I'm reading it right, but the contributor graph looks like it's only 1-2 people working on each of the projects.
    - kristopolous 2y ago
      I hate to break it to you but that's a large percentage of open source projects. The high majority of code is by a low minority of people I think this is because the barrier to meaningfully contribute is too high simply because large code bases are almost always complicated and hard to understand. There's a few extraordinary exceptions (NetBSD source comes to mind) but they're extreme outliers
    - kirici 2y ago
      The first two are forks that fundamentally did not change all that much, the latter aims to create a "true" opensource alternative of VSCode (including the ecosystem, where VSCodium falls flat) to serve as a common base for (and by) a few industry giants to build their next-gen of IDEs on top of (an "IDE framework", per their description). As for the first two, last I checked openvscode-server was just enough to host VSCode for the browser, code-server had a few extras, like hosting at a subpath.
joaomoreno 2y ago
> It works well though, particularly over SSH and devcontainers, although it has severe bugs that they refuse to fix, and it isn't open source so you can't fix it yourself. VS Code dev here. Would you like to share that list of severe bugs? Also, can you clarify what exactly isn't open-source in the entire VS Code with SSH and devcontainers flow? It's disheartening to read this, knowing that this simply isn't true.
- larsnystrom 2y ago
  Where is the Remote SSH extension code? I always thought that was closed source? Edit: The reason I think it is closed source is because a StackOverflow answer says so[1]. I’d be very interested in seeing the code if you could link to its repo! [1] https://stackoverflow.com/a/55979526 https://stackoverflow.com/a/55979526
- Squeeze2664 2y ago
  The remote development extensions don't appear to be open-source. The marketplace page for the "Remote - SSH" extension will point you to a license that says, among other things, "You may not: work around any technical limitations in the software;". The same page brings you to a github repo for the extension that contains no source code; it claims to be for gathering feedback only. I don't know how you can imply everything about this is open source, maybe I'm not looking in the right place?
- joaomoreno 2y ago
  This is what posting sleep deprived gets you. I was referring to the cli[0] and server[1] components, which have most of the meat. Sorry for the misunderstanding. That being said, I'd love to know which severe bugs disrupt your usage. [0] https://github.com/microsoft/vscode/tree/main/cli https://github.com/microsoft/vscode/tree/main/cli [1] https://github.com/microsoft/vscode/tree/main/src/vs/server https://github.com/microsoft/vscode/tree/main/src/vs/server
  - boatt 2y ago
    You should have asked Bing to filter your thoughts for you before you posted.
cruffle_duffle 2y ago
Just here to say that the editor wars this comment kicked off are classic. It’s comforting to know that some things never change. /written using pico on my Blackberry RIM. Because physical keyboards matter and pico is easy to use.
spixy 2y ago
How does VScode promote C#? I have tried writing C# in it and it was a mess. Visual Studio is much superior.
- alternatex 2y ago
  VSCode promotes Visual Studio by being terrible at C# development. /s
TeMPOraL 2y ago
> I wish software was secure by design, like browsers are. I don't. Browsers are already close to "security or utility, pick one"[0] if you try to go beyond the TV + form filling appliance experience. I don't want this kind of thinking to leak out to all software I use. Like, I'm happy to be able to write: find . -type f [stuff] -exec rg 'foobar' {} + without worrying about rg (or anything) refusing to run because its vendor didn't set up Access-Control-Allow-Origin header correctly, or similar such bullshit that's just commonplace whenever you try to operate (instead of consuming) or integrate anything on the web. And no, I don't want to have to buy a domain and publicly spell out my computers and get them legit certificates just so they're allowed to talk with each other when physically next to each other and on the same LAN. I don't want my OS to start looking like Android either, where everything is hidden and nothing is allowed to talk to anything else - i.e. literally the opposite of the promise Android started with. -- [0] - Security and usefulness are fundamentally opposing forces. In the limit, the most secure computer system is a dead rock.
- alternatex 2y ago
  First time I see someone criticize Access-Control-Allow-Origin. You do realize it prevented countless script injection attacks from affecting users? Most of whom are not people who are on the web for the purposes of hacking random integrations. Also seems like your idea of integration is using someone else's server without permission.
  - TeMPOraL 2y ago
    > First time I see someone criticize Access-Control-Allow-Origin. From the POV of API integrations it's basically annoyance. It doesn't prevent or discourage using an endpoint from scripts and applications except browsers, which voluntarily handle it and also don't give the end-user any control over it. > You do realize it prevented countless script injection attacks from affecting users? I do. We're talking about making software as secure as web browsers. I can begrudgingly accept that the World Wide Web is what it is because it is World Wide, but I don't want any of this bullshit to spill over to general-purpose personal computers. It's bad enough that we increasingly do most of our computing in the browsers. > Also seems like your idea of integration is using someone else's server without permission. Not server but software, and the very phrasing of it is... I don't know where to even begin addressing it. I am not and am never gonna ask permission to use software for whatever purpose I want. That's, like, the basic philosophy of computing. Integrations - voluntary or not - are basically an extension of that. Adversarial interoperability is a sad necessity today, but we're not even talking about that - we're talking transplanting "browser security" like CORS to places and use cases where it would be mostly annoying, leaving users at the mercy of the software provider to kindly relax the security flag a bit.
n144q 2y ago
That's a lot of accusations without evidence. VSCode does questionable things, but nowhere near the levels you are describing. And is there any evidence that VSCode is not secure, by Node.js standard? Has there been significant security incidents that were not handled properly? Has VSCode been neglecting security issues? No to all those questions, based on my experience. Node.js inherently is loose on permissions -- by default you can do IO/connect to Internet however you want -- but that's not VSCode's fault. Otherwise, VSCode team has been very responsive at handling security issues. (Saying this as an experienced VSCode user and extension developer.)
deleted 2y ago
[deleted]
nsonha 2y ago
Cool theory but no one uses typescript, github or C# because of VSCode. It's a nonsensical narative if you just spend more than a few seconds thinking about it. All those things dominated their niche before VSCode came into the picture. Any better product can be accused of "trying to suffocate the OSS alternatives". Do Microsoft somehow have the power to make other OSS projects suck?

jeffbee 2y ago

Eclipse theia. It is an almost pixel-perfect ripoff of VS Code that integrates the open source components such as Monaco. It is what you are using if you've ever started a Google Cloud Shell Editor.

TiredOfLife 2y ago
Theia embraced the Monaco editor. Are extending it and now are trying to extinguish VS Code.
brabel 2y ago
Amazing that most commenters seem to even be unaware of Eclipse Theia which is basically THE open-source VSCode. They need better marketing (well, being open-source, they'll never have great marketing like MSFT, of course).
- exceptione 2y ago
  I would add: ...and being Eclipse they will have no marketing at all. Eclipse offers tons of interesting IDE's, languages ranging from C, Java, PHP, there used to be Haskell support as well. Granted, not every language has the same depth of features, and some plugins are practically abandoned. There are tools for the automotive industry, tools for building Dsl's and IDEs, hardware programming, the list goes on. Eclipse is built as an IDE, but also as a platform to build your own IDE. I think that DBeaver is also based on Eclipse-the-platform. But eclipse also reinforces memes, look at eclipse.org - Software from the US: Great marketing, invasive, beginner friendly, attention to UX, great design, steals your data by default. - Software from the EU: Deeply buried on a 2007 website, great feature depth, interface tailored to power users, designers have been killed, community equals you + 20 experts on some mailing list, no data sharing or only as opt-in (they are just memes, with a pinch of truth)
PeterStuer 2y ago
After decades of using IDE's from Think Pascal/C, MCL, Borland C++/JBuilder and lots of Visual Studio and mostly PyCharm these days, I was forced to use an Eclipse IDE for a model driven dev project a few years ago. Worst IDE experience ever and this tainted the 'Eclipse' brand for me forever.

hedora 2y ago

Vscodium is open source, and ssh mode works. I don’t think copilot does.

evilduck 2y ago
Cline, Roo, and Continue all work with Codium though, so it's not a big loss.
Arrowmaster 2y ago
Since when? Last time I looked the remote ssh plugin wasn't open source and refused to run on forks?
- hedora 2y ago
  There is an open source reimplementation (or two?) I thought I used this one: https://github.com/xaberus/vscode-remote-oss https://github.com/xaberus/vscode-remote-oss and everything just worked, though the directions on that page look complicated, so it might be the wrong project. It was in the store that ships with the open source build and was definitely open source.
kristopolous 2y ago
this looks like the chromium version of vscode, so long as we're both talking about the same thing: https://vscodium.com/ https://vscodium.com/

goldencoralefan 2y ago

Zed. It is written in a compiled language and it’s C++ extension doesn’t take down my servers.

jay_kyburz 2y ago
Ohh, interesting to see they have Linux builds available now.
o11c 2y ago
Zed was in the news recently for the exact same security flaw.

bongodongobob 2y ago

VSCode is great. If it suffocates other products, that's their fault for not being better. MS hate for hate sake is fucking old, do better.

KronisLV 2y ago
I don’t think people like the principle behind it: https://en.m.wikipedia.org/wiki/Embrace,_extend,_and_extinguish https://en.m.wikipedia.org/wiki/Embrace,_extend,_and_extingu... Same reason why some people are adamantly against using closed source software though at least https://github.com/VSCodium/vscodium https://github.com/VSCodium/vscodium exists. That said, personally I use OSes like Windows or IDEs like JetBrains sometimes just because they help me get things done, it is what it is.
- kristiandupont 2y ago
  Other companies don't say EEE (MS also doesn't anymore, as far as I know), but that doesn't mean they are any better. In fact, I would say that Apple is far more guilty of doing this than MS is these days. But even so, what is the alternative? If MS creates any good product, people will accuse them of being at some phase in EEE, which is unfalsifiable.
  - KronisLV 2y ago
    I guess the alternative would be for MS to make this great product fully FOSS, so that there wouldn’t be a problem in the first place. But ofc that isn’t realistic for a plethora of reasons. Also not saying that MS is somehow unique or worse than Apple, or Google or whatever, they each have their good and bad bits.
  - andy81 2y ago
    It's Microsoft's actions which lose them trust, regardless of what they might state in official communications. Actions like the C# dev kit license footgun/rug pull, the closed source remote development extensions, and training copilot on GPL while pretending that you own any code it generates. You don't need even need a rant on the Windows team, it would be beating a dead horse.

csdreamer7 2y ago

> VSCode is an IDE designed to suffocate the open source alternatives, so that they retain full strategic control What open source alternatives? Atom was a mess that kept breaking. LSP plugins are now used in almost every featureful editor and have really made editing a lot better. You spent more time configuring Vim and Emacs than they saved you. Microsoft made a really good code editor that set a standard and likely took market share from their own (mostly Windows) Visual Studio. I do not use it anymore because of the creep of closed source plugins (+ they keep breaking my workflow) but I still think it is a great improvement. > I wish software was secure by design, like browsers are. Someone does not remember (or was not around) for the ActiveX or Flash days.

skydhash 2y ago
> You spent more time configuring Vim and Emacs than they saved you I trade whatever default workflow that VSCode and other IDEs are imposing for a better editing experience. And even the initial time investment is short these days due to the trove of config and tutorials online. After learning Vim, I ditched the files explorer and embrace the buffer workflow instead. Opening many windows at the same time to peek at multiple files, then switching to a new tab only if I don’t want to lose the current windows configuration. Then fuzzy searching for navigation, and using the quickfix list for search and errors. No friction from thought to action. Another plus for me. I have an emacs session opened for weeks now inside a VM on my desktop to work on a side project. Whatever the computer (laptops or said desktopj, it’s a quick ssh, then resuming the dtach sessiom and my workspace is ready. Multiple files opened (almost all of them), a postgresql REPL, Tasks runners, and a lot of packages (magit, project.el, consult,…) working together to streamline working on code.
- eru 2y ago
  > I trade whatever default workflow that VSCode and other IDEs are imposing for a better editing experience. And even the initial time investment is short these days due to the trove of config and tutorials online. You can configure VSCode with plugins. They aren't imposing any more defaults than vim or emacs do.

m463 2y ago

> I wish software was secure by design, like browsers are. I feel this is one of those "repeat it until it is true" marketing things, like "apple believes privacy is a fundamental right" But really, I think vscode, browsers and apple products only tangentially secure because business goals, features and convenience trump these kinds of broad statements. I so wish it was otherwise. There are so few islands of common sense in our world and the water level keeps rising.

white-flame 2y ago
I think it's more a case that browsers take security into account at the feature design phase, whereas other applications don't. That's actually a huge step in the right direction. Same thing with mobile OSes, which have a very preferable decision to sandbox individual applications, instead of running them with full user permissions & full user data access, like desktop OSes do. Now, whether the browsers or mobile OSes actually are secure because of that, is a separate thing, but those are good steps to take.
- idle_zealot 2y ago
  > which have a very preferable decision to sandbox individual applications, instead of running them with full user permissions It's great that they took security into account during the design phase. I wish they had also taken into account user empowerment. They sandboxed all the apps and in so doing made interoperation, plugins, patches, mods, etc basically impossible. Now the most widely-used form of personal computer is more like a portal to digital services than it is a computing platform. It's sad to see, and I refuse to believe that it's one-or-the-other when it comes to security vs power.
- worthless-trash 2y ago
  > I think it's more a case that > browsers take security into > account at the feature design > phase. I think that many software people do this. It's likely that you are more familiar with a browsers development cycle.
curt15 2y ago

otabdeveloper4 2y ago

> what's the point of having a very secure IDE if they immediately run curl|sudo bash Docker is a technology that downloads random unsigned tarballs from the Internet and runs them as root. Also it turns off your system firewall in the process, to make all this more "convenient". Really we have much more low-hanging fruit to pick.

KronisLV 2y ago
They’re working on signing: https://docs.docker.com/engine/security/trust/ https://docs.docker.com/engine/security/trust/ They have a rootless mode: https://docs.docker.com/engine/security/rootless/ https://docs.docker.com/engine/security/rootless/ Firewall situation is mixed: https://docs.docker.com/engine/network/packet-filtering-firewalls/#integration-with-firewalld https://docs.docker.com/engine/network/packet-filtering-fire... It’s a bummer that those aren’t the defaults, but it would directly make things less convenient and therefore make people less likely to use it (same reason why installing various software is still offered as a Bash script that you curl and pipe to your terminal, e.g. Ollama; at least it’s not offered as the only way usually), what a world.
Sophira 2y ago
This is pretty much exactly why I've never used Docker up to now, as cool as it seems.

kristopolous 2y ago

"Runpod's openvscode-server" I searched, couldn't find it. what are you talking about?

kirici 2y ago
I'd guess that there was a mixup: https://github.com/gitpod-io/openvscode-server https://github.com/gitpod-io/openvscode-server For what it's worth, we have been using code-server instead in prod (prod being internal) for over a year now. https://github.com/coder/code-server https://github.com/coder/code-server https://coder.com/docs/code-server/FAQ#whats-the-difference-between-code-server-and-openvscode-server https://coder.com/docs/code-server/FAQ#whats-the-difference-...
- concerndc1tizen 2y ago
  How would you compare the three options, - https://github.com/gitpod-io/openvscode-server https://github.com/gitpod-io/openvscode-server - https://github.com/coder/code-server https://github.com/coder/code-server - https://github.com/eclipse-theia/theia https://github.com/eclipse-theia/theia I'm not sure if I'm reading it right, but the contributor graph looks like it's only 1-2 people working on each of the projects.
  - kristopolous 2y ago
    I hate to break it to you but that's a large percentage of open source projects. The high majority of code is by a low minority of people I think this is because the barrier to meaningfully contribute is too high simply because large code bases are almost always complicated and hard to understand. There's a few extraordinary exceptions (NetBSD source comes to mind) but they're extreme outliers
  - kirici 2y ago
    The first two are forks that fundamentally did not change all that much, the latter aims to create a "true" opensource alternative of VSCode (including the ecosystem, where VSCodium falls flat) to serve as a common base for (and by) a few industry giants to build their next-gen of IDEs on top of (an "IDE framework", per their description). As for the first two, last I checked openvscode-server was just enough to host VSCode for the browser, code-server had a few extras, like hosting at a subpath.

joaomoreno 2y ago

> It works well though, particularly over SSH and devcontainers, although it has severe bugs that they refuse to fix, and it isn't open source so you can't fix it yourself. VS Code dev here. Would you like to share that list of severe bugs? Also, can you clarify what exactly isn't open-source in the entire VS Code with SSH and devcontainers flow? It's disheartening to read this, knowing that this simply isn't true.

larsnystrom 2y ago
Where is the Remote SSH extension code? I always thought that was closed source? Edit: The reason I think it is closed source is because a StackOverflow answer says so[1]. I’d be very interested in seeing the code if you could link to its repo! [1] https://stackoverflow.com/a/55979526 https://stackoverflow.com/a/55979526
Squeeze2664 2y ago
The remote development extensions don't appear to be open-source. The marketplace page for the "Remote - SSH" extension will point you to a license that says, among other things, "You may not: work around any technical limitations in the software;". The same page brings you to a github repo for the extension that contains no source code; it claims to be for gathering feedback only. I don't know how you can imply everything about this is open source, maybe I'm not looking in the right place?
joaomoreno 2y ago
This is what posting sleep deprived gets you. I was referring to the cli[0] and server[1] components, which have most of the meat. Sorry for the misunderstanding. That being said, I'd love to know which severe bugs disrupt your usage. [0] https://github.com/microsoft/vscode/tree/main/cli https://github.com/microsoft/vscode/tree/main/cli [1] https://github.com/microsoft/vscode/tree/main/src/vs/server https://github.com/microsoft/vscode/tree/main/src/vs/server
- boatt 2y ago
  You should have asked Bing to filter your thoughts for you before you posted.

cruffle_duffle 2y ago

Just here to say that the editor wars this comment kicked off are classic. It’s comforting to know that some things never change. /written using pico on my Blackberry RIM. Because physical keyboards matter and pico is easy to use.

spixy 2y ago

How does VScode promote C#? I have tried writing C# in it and it was a mess. Visual Studio is much superior.

alternatex 2y ago
VSCode promotes Visual Studio by being terrible at C# development. /s

TeMPOraL 2y ago

> I wish software was secure by design, like browsers are. I don't. Browsers are already close to "security or utility, pick one"[0] if you try to go beyond the TV + form filling appliance experience. I don't want this kind of thinking to leak out to all software I use. Like, I'm happy to be able to write: find . -type f [stuff] -exec rg 'foobar' {} + without worrying about rg (or anything) refusing to run because its vendor didn't set up Access-Control-Allow-Origin header correctly, or similar such bullshit that's just commonplace whenever you try to operate (instead of consuming) or integrate anything on the web. And no, I don't want to have to buy a domain and publicly spell out my computers and get them legit certificates just so they're allowed to talk with each other when physically next to each other and on the same LAN. I don't want my OS to start looking like Android either, where everything is hidden and nothing is allowed to talk to anything else - i.e. literally the opposite of the promise Android started with. -- [0] - Security and usefulness are fundamentally opposing forces. In the limit, the most secure computer system is a dead rock.

alternatex 2y ago
First time I see someone criticize Access-Control-Allow-Origin. You do realize it prevented countless script injection attacks from affecting users? Most of whom are not people who are on the web for the purposes of hacking random integrations. Also seems like your idea of integration is using someone else's server without permission.
- TeMPOraL 2y ago
  > First time I see someone criticize Access-Control-Allow-Origin. From the POV of API integrations it's basically annoyance. It doesn't prevent or discourage using an endpoint from scripts and applications except browsers, which voluntarily handle it and also don't give the end-user any control over it. > You do realize it prevented countless script injection attacks from affecting users? I do. We're talking about making software as secure as web browsers. I can begrudgingly accept that the World Wide Web is what it is because it is World Wide, but I don't want any of this bullshit to spill over to general-purpose personal computers. It's bad enough that we increasingly do most of our computing in the browsers. > Also seems like your idea of integration is using someone else's server without permission. Not server but software, and the very phrasing of it is... I don't know where to even begin addressing it. I am not and am never gonna ask permission to use software for whatever purpose I want. That's, like, the basic philosophy of computing. Integrations - voluntary or not - are basically an extension of that. Adversarial interoperability is a sad necessity today, but we're not even talking about that - we're talking transplanting "browser security" like CORS to places and use cases where it would be mostly annoying, leaving users at the mercy of the software provider to kindly relax the security flag a bit.

n144q 2y ago

That's a lot of accusations without evidence. VSCode does questionable things, but nowhere near the levels you are describing. And is there any evidence that VSCode is not secure, by Node.js standard? Has there been significant security incidents that were not handled properly? Has VSCode been neglecting security issues? No to all those questions, based on my experience. Node.js inherently is loose on permissions -- by default you can do IO/connect to Internet however you want -- but that's not VSCode's fault. Otherwise, VSCode team has been very responsive at handling security issues. (Saying this as an experienced VSCode user and extension developer.)

deleted 2y ago

[deleted]

nsonha 2y ago

Cool theory but no one uses typescript, github or C# because of VSCode. It's a nonsensical narative if you just spend more than a few seconds thinking about it. All those things dominated their niche before VSCode came into the picture. Any better product can be accused of "trying to suffocate the OSS alternatives". Do Microsoft somehow have the power to make other OSS projects suck?