VSCodium: Binary releases of VSCode without MS branding, telemetry and licensing

Re:VSCodium: Binary releases of VSCode without MS branding, ... by floatingatoll on Monday August 27, 2018 @10:26AM (#17851669)

If I needed a one-time “use it and lose it” attack vector, this would be an excellent way to provide one. Imagine how many thousands of code repositories I could _successfully_ inject a backdoor into, using only a repackaged “without the telemetry” version of Microsoft’s code. Y’all are far too trusting.

Edit: The point is that we all have a blind spot around risk assessment and threat evaluation when it comes to certain software topics, such as code editors and terminal software.

[ Parent | on HN ]

Re:VSCodium: Binary releases of VSCode without MS branding, ... by TimTheTinker on Monday August 27, 2018 @10:51AM (#17851826)

Never trust a binary more than you trust the person who built it and the channel you downloaded it through.

A better method might be to fork VSCode’s repo and modify the build scripts and/or code to remove telemetry.

[ Parent | on HN ]

Re:VSCodium: Binary releases of VSCode without MS branding, ... by hsribei on Monday August 27, 2018 @11:02AM (#17851898)

The repo has the scripts that are used to compile the binaries. It's not even a fork, it just downloads the code directly from the official repo.

[ Parent | on HN ]

Re:VSCodium: Binary releases of VSCode without MS branding, ... by floatingatoll on Monday August 27, 2018 @11:09AM (#17851940)

Gentoo’s biggest failure to me is in persuading people that building from source is somehow safer than binaries.

Never trust a source code repository more than you trust the people who commit it and the channel you downloaded it through.

Autoupdates from a source repository that you don’t review before accepting updates are no safer than autoupdates from a binary source.

[ Parent | on HN ]

Re:VSCodium: Binary releases of VSCode without MS branding, ... by craftyguy on Monday August 27, 2018 @12:03PM (#17852257)

> Gentoo’s biggest failure to me is in persuading people that building from source is somehow safer than binaries.

I don't think this is a big reason Gentoo users use Gentoo. At least not the knowledgeable ones.

[ Parent | on HN ]

Re:VSCodium: Binary releases of VSCode without MS branding, ... by Zancarius on Monday August 27, 2018 @04:27PM (#17854211)

> I don't think this is a big reason Gentoo users use Gentoo.

Exactly. The two most compelling reasons to use Gentoo are/were: 1) It's a rolling-release distribution and 2) it offers customization by virtue of building from source. I don't think I've seen the argument that it's more secure--not seriously anyway. I used it back then because I wasn't a huge fan of Linux and Gentoo seemed more familiar to me with its ports analog.

Perhaps part of the OP's confusion is the hardened profile (or similar)? I'm not sure considering their wiki currently advertises it as risk mitigation [1], but I haven't used Gentoo in probably 6-7 years (at least not consistently outside a VM) so my memory on this is likely wrong.

[1] https://wiki.gentoo.org/wiki/Hardened_Gentoo

[ Parent | on HN ]

Re:VSCodium: Binary releases of VSCode without MS branding, ... by floatingatoll on Wednesday September 05, 2018 @07:37PM (#17922783)

To clarify: Gentoo did no harm. Many Gentoo users cited the risks of prebuilt binaries in their evangelism of Gentoo. That perceived risk remains an undercurrent in people’s thinking today, even though we’ve generally since realized that prebuilt binaries aren’t the risk we were led to believe they were back then. I blame the Gentoo evangelists of yesterdecade for this persistent “anti-binary” mindset, not Gentoo itself.

[ Parent | on HN ]

Re:VSCodium: Binary releases of VSCode without MS branding, ... by fredch on Monday August 27, 2018 @11:23AM (#17852020)

Shameful FUD

[ Parent | on HN ]