News for hackers. Stuff that matters.
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by z3t4 on Friday April 12, 2019 @09:15PM (#19650447)
It maybe starts with simple statistics. But then you want to know what features the user use, then you want to know what other programs they have installed. Then you want to know what the users search for on the web. etc. It's a slippery slope.
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by eridius on Saturday April 13, 2019 @12:24AM (#19651115)
Why would Microsoft gathering usage data about VSCode turn into spying on the user's other apps and web searches? There's no connection between the two. Tracking usage of VSCode features has a clear connection towards improving VSCode. Spying on the user's activity outside of VSCode has no connection at all to improving VSCode.
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by naikrovek on Saturday April 13, 2019 @04:08AM (#19651709)
Every time I hear the phrase "it's a slippery slope" uttered by someone arguing against something, I am immediately suspicious of the argument that person is making.

There really isn't such a thing, in the way you've used that phrase.

Capturing telemetry on how I use a tool from within that tool is perfectly fine, to me. Collecting telemetry on my search history in the browser by that same tool isn't. THERE ARE NO INTERIM STEPS that makes the second of those ok. There is no slope. If there is, it isn't slippery. There is a series of discreet decisions and at some point (which is different for everyone) a line is crossed. There was no slope or slip that brought you there, only a series of mostly unrelated decisions.

To think that Microsoft's long-term goal is to install a keystroke logger via a multi-decade and multi-phase plan that begins with application usage telemetry in a free developer tool thanks to "a slippery slope" is just simply not realistic.

Re:VSCodium – An Open Source Visual Studio Code Without Trac... by wolco on Saturday April 13, 2019 @09:39AM (#19652948)
When you walk in the wrong direction the final step off the cliff is the last one. Better to get off of the slope because choices get fuzzier the closer you get to the sun.
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by tdesilva on Saturday April 13, 2019 @05:02AM (#19651885)
It's called a fallacy for good reason.
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by z3t4 on Saturday April 13, 2019 @10:00AM (#19653052)
Im not making that up, it was in the TOS for VS/code last time I checked.
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by joshschreuder on Friday April 12, 2019 @09:34PM (#19650507)
You've literally described a slippery slope fallacy
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by colordrops on Friday April 12, 2019 @10:09PM (#19650636)
It's not a fallacy. When a printer driver reporting stats back to the manufacturer made national news in the early 2000s and prompted calls for laws regulating privacy, the argument was that it was a slippery slope fallacy to assert that privacy violations would get worse. Look at where we are now.
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by enraged_camel on Friday April 12, 2019 @10:21PM (#19650690)
>>It's not a fallacy.

By itself no, but it is often used fallaciously. Such as in this case, when someone is opposing some good thing on the basis that that good thing might, some day, lead to bad things.

Re:VSCodium – An Open Source Visual Studio Code Without Trac... by jjeaff on Friday April 12, 2019 @11:30PM (#19650945)
Not realizing that many things actually ARE a slippery slope is what has gotten the world into a lot of messes. Nearly every legitimate privacy concern that we have today started out with a legitimate and we'll meaning purpose.

Our entire legal system is predicated on common law precedent. So it is very valid in many cases to argue that allowing something good now, might set us up for something very bad later.

Re:VSCodium – An Open Source Visual Studio Code Without Trac... by pushpop on Saturday April 13, 2019 @03:11AM (#19651510)
What you’ve described there is exactly how bad things come to be.

You think people elect for bad things? Bad governments, bad software or privacy violations? They chose things that are full of rhetoric and promises of good things then those bad things get snuck in off the back off relaxed regulation, or existing software adoption, etc.

Take Facebook as an example, people didn’t sign up to it thinking “I wanted to be tracked around the internet so I can have personalised adverts” nor dis Zuckerburg think “Wouldn’t it be good to create a platform that could latter be used for rigging elections”. No, instead we got there because of a serious of good ideas that slowly got abused.

There is a saying that goes “The path to hell is paved by good intentions.” I’m not a religious man but I think that beautifully illustrates how slippery slopes are not a logical fallacy.

Re:VSCodium – An Open Source Visual Studio Code Without Trac... by steve_taylor on Friday April 12, 2019 @10:41PM (#19650784)
Good things such as trackers ostensibly designed to deliver you relevant content?
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by enraged_camel on Friday April 12, 2019 @10:51PM (#19650807)
No, good things such as telemetry and automated error reporting so that bugs can be fixed effectively and efficiently and everyone is better off for it.
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by wolco on Saturday April 13, 2019 @09:43AM (#19652968)
That sounds nice. But could they use this data legally in another way?
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by jlawson on Friday April 12, 2019 @09:47PM (#19650555)
"Slippery slope" is not a fallacy. Life is full of slippery slopes in terms of behavior.
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by dymk on Friday April 12, 2019 @09:57PM (#19650590)
https://en.wikipedia.org/wiki/Slippery_slope#Non-fallacious_...

No, that still falls into fallacious usage.

The user doesn't justify why the steps of their assertion follow after the other. Just that they... do.

Re:VSCodium – An Open Source Visual Studio Code Without Trac... by steve_taylor on Friday April 12, 2019 @10:44PM (#19650791)
No one needs to justify the "why" when we're talking about a very well trodden slippery slope.
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by dymk on Friday April 12, 2019 @11:13PM (#19650883)
Fallacies don't just stop applying when it's convenient to elide justification.
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by Sir_Substance on Friday April 12, 2019 @11:26PM (#19650932)
That's true. However, we also don't collect history for the fun of it.

Over the course of the last 20 years, we've seen that once a data collection and digital surveillance framework is put in place, the surveillance tends to expand.

Slippery slope arguments, sans good reasoning, tend to be fallacies. However, don't fall into the trap of thinking that an argument backed by historical record is a slippery slope just because it's predicting an outcome. We might call that the "history is all slippery slopes" fallacy. Stating "this has happened before multiple times before, and each time has lead to x" is a very different argument to stating "this has happened, so the logical extrapolation is x".

Re:VSCodium – An Open Source Visual Studio Code Without Trac... by justatdotin on Saturday April 13, 2019 @02:45AM (#19651458)
if it can be that well trodden, is it really still a slippery slope?
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by mixmastamyk on Friday April 12, 2019 @10:53PM (#19650811)
Overwhelming empirical data across history.
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by johncolanduoni on Friday April 12, 2019 @11:11PM (#19650878)
That’s proof of existence of slippery slopes, not of prevelance of hypothetical slippery slopes being realized.
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by mixmastamyk on Friday April 12, 2019 @11:25PM (#19650927)
We’re talking about data collection and usage, not possibilities in the universe.
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by johncolanduoni on Saturday April 13, 2019 @10:56PM (#19657304)
Exactly, which is why I'd be more interested in concrete commonalities of slippery slopes that were actually realized, and not just a general "history has plenty of slippery slopes".
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by asdfasgasdgasdg on Friday April 12, 2019 @10:21PM (#19650692)
The fallacy is to assume, without evidence, that the slope is slippery. There are plenty of slopes that aren't. Probably most, just you don't think about those because you know they aren't slippery already.

For example, I slept in 'til 8:30 today. OMG, a slippery slope. Next thing you know, I'll be sleeping until 3PM. Til midnight! I will never wake up again. But as it happens, sleeping in isn't a slippery slope. I don't think there's any solid evidence that telemetry is either.

Re:VSCodium – An Open Source Visual Studio Code Without Trac... by iopq on Friday April 12, 2019 @10:45PM (#19650795)
Umm, it's slippery for me. I haven't had a stable sleeping schedule for over ten years. Send help.
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by sitkack on Friday April 12, 2019 @10:38PM (#19650770)
This is exactly why I get up a minute earlier each day. As it is, I am waking up tomorrow at 4:39 AM. Mission accomplished.
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by TimTheTinker on Saturday April 13, 2019 @02:21AM (#19651400)
(10 years into one possible future)

“... and that was me before we had children.”

Re:VSCodium – An Open Source Visual Studio Code Without Trac... by colordrops on Saturday April 13, 2019 @07:11PM (#19656369)
That's the "hasty counterexample" fallacy.
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by millstone on Friday April 12, 2019 @10:13PM (#19650656)
I think it sends MS every keypress in search fields - https://github.com/Microsoft/vscode/issues/49161
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by zeusk on Friday April 12, 2019 @10:25PM (#19650707)
If you had actually read that issue,

> Lol, probably just an oversight because they made the search a lot better.

> So I think it only does this on the settings file and not on other files ;)

> https://code.visualstudio.com/blogs/2018/04/25/bing-settings...

Re:VSCodium – An Open Source Visual Studio Code Without Trac... by kotrunga on Friday April 12, 2019 @11:39PM (#19650969)
No matter what, it's an opt-out setting that can only be disabled with:

"workbench.settings.enableNaturalLanguageSearch": false

That's unacceptable.

Re:VSCodium – An Open Source Visual Studio Code Without Trac... by Stuckinsofa on Friday April 12, 2019 @11:48PM (#19651013)
Can you explain why this search feature is a problem because I don't understand?
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by userbinator on Saturday April 13, 2019 @12:21AM (#19651110)
Maybe not understanding the problem with a tool that may be used to work on proprietary code containing trade secret information silently and unexpectedly sending information out to the Internet is the reason for software becoming spyware...
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by zeusk on Saturday April 13, 2019 @12:28AM (#19651125)
Emphasizing from my original post,

>> it only does this on the (VSCode) settings file and not on other files ;)

Re:VSCodium – An Open Source Visual Studio Code Without Trac... by userbinator on Saturday April 13, 2019 @12:57AM (#19651186)
Starting with "Lol, probably just an oversight" and ending with an emoticon is excessively dismissive and flippant... that's how you lose customers, or potential ones.
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by Stuckinsofa on Saturday April 13, 2019 @01:55PM (#19654587)
You store trade secrets in your configuration file? I still don't understand what the big issue is. Can you clarify that instead of critizising my lack of knowledge?
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by DEADBEEFC0FFEE on Friday April 12, 2019 @09:40PM (#19650528)
It's a shame we have to assume the worst. What would be better is for Microsoft to be more transparent about the telemetry and to enable more granular control. That said, I wouldn't bother checking as I don't really care. I rub shoulders with infosec issues daily, as most IT folk do these days. When I think about the perceived risk of telemetry from VSCode, now and in the future it's a negligible risk that I accept.
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by jakear on Friday April 12, 2019 @09:57PM (#19650589)
They are actually very transparent about the telemetry they collect, and they offer granular control. There is a log of all events sent to MS, and a page in settings dedicated to the different types of telemetry they can be enabled.
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by mkl on Saturday April 13, 2019 @01:46AM (#19651299)
Where is the log stored? All I can find online are some instructions that seem out of date as they don't refer to the interface I see (or I don't understand them): "You can inspect telemetry events in the Output panel by setting the log level to Trace using Developer: Set Log Level from the Command Palette." [1]

The "page" in settings consists of just two options, and the complete descriptions of the types of information they collect are "crash reports" and "usage data and errors". That seems the opposite of transparent and granular. Am I missing something?

[1] https://code.visualstudio.com/Docs/supporting/FAQ

Re:VSCodium – An Open Source Visual Studio Code Without Trac... by naikrovek on Saturday April 13, 2019 @04:25AM (#19651755)
Windows has an overarching telemetry collection system and VSCode might use that on Windows.

There is an application in the Microsoft store you can install that lets you view all telemetry collected by Microsoft, and the actual data is encrypted. The metadata (which tells you WHAT is being collected) is not. Knowing the people I have worked with in the past, this is to securely prevent modification by users before the data is actually sent. I've worked with lots of people who would modify that data to attempt to get a feature added that they wanted or just to screw with MS.

That tool also gives you the option to delete all telemetry sent from that machine in Microsoft's possession.

Re:VSCodium – An Open Source Visual Studio Code Without Trac... by mkl on Saturday April 13, 2019 @07:10AM (#19652277)
Thanks. The app is called Diagnostic Data Viewer.
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by naikrovek on Saturday April 13, 2019 @04:30AM (#19651764)
The command pallette is what you see when you press CTRL+SHIFT+P, and typing 'set log level' in that dialog will bring up a search result you can click to set the log level' (the level of stuff that gets shown in the Output pane).

Setting that to "Trace" will show the telemetry being sent in the Output pane of the interface, amongst a bunch of other stuff, I am sure.

Re:VSCodium – An Open Source Visual Studio Code Without Trac... by specialist on Friday April 12, 2019 @11:31PM (#19650947)
FWIW, I'm completely comfortable with telemetry, analytics, whatever so long as 1) there's a complete local log and 2) I can opt-out.
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by felixgallo on Friday April 12, 2019 @10:10PM (#19650643)
Incorrect. That page has essentially no detail.
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by savant_penguin on Saturday April 13, 2019 @12:09AM (#19651079)
IMO they could get whatever statistics they wanted, as long as they asked before collecting
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by chii on Saturday April 13, 2019 @12:11AM (#19651085)
and also, what they intend to use said statistics for.
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by nwah1 on Friday April 12, 2019 @10:18PM (#19650674)
One could be totally uncritical about the current or future intentions of Microsoft and still prefer a version with no telemetry. Data breaches are very common. Employees, hackers, or governments could all gain access to the data.

The data could be accidentally broadcast or left in a vulnerable place. Even the payroll data for the national security establishment was once reported to be compromised. Everything is vulnerable. Computer science is in such an abysmal state.

Even with properly configured servers, OSes, and databases that are up to date, they are still vulnerable to zero-day attacks because they are not formally verified and have enormous and largely unnecessary complexity. Then throw in the crazy complexity of processor instruction sets, creative side-channel attacks, and stuff which exploits the physical properties of the hardware (rowhammer).

It is reasons like these why we should never really trust transmission of sensitive data over the internet. The concept of secure voting systems, for instance, is literally a joke. insert obligatory xkcd here

Re:VSCodium – An Open Source Visual Studio Code Without Trac... by est31 on Saturday April 13, 2019 @03:08AM (#19651503)
Yeah, there is a reason why the Kremlin uses mechanical typewriters.
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by ryder9 on Friday April 12, 2019 @09:45PM (#19650549)
you should read up on slipper slope fallacy

https://en.wikipedia.org/wiki/Slippery_slope

Re:VSCodium – An Open Source Visual Studio Code Without Trac... by pissfu on Friday April 12, 2019 @10:20PM (#19650681)
did you read the article you linked?

"Logic and critical thinking textbooks typically discuss slippery slope arguments as a form of fallacy but usually acknowledge that "slippery slope arguments can be good ones if the slope is real—that is, if there is good evidence that the consequences of the initial action are highly likely to occur. The strength of the argument depends on two factors. The first is the strength of each link in the causal chain; the argument cannot be stronger than its weakest link. The second is the number of links; the more links there are, the more likely it is that other factors could alter the consequences.""

https://en.wikipedia.org/wiki/Slippery_slope#Non-fallacious_...

Re:VSCodium – An Open Source Visual Studio Code Without Trac... by eridius on Saturday April 13, 2019 @12:25AM (#19651120)
Where's the link between "collecting data on VSCode feature usage" and "gathering a list of all other apps the user has installed on their system and all web searches the user does"?
Re:VSCodium – An Open Source Visual Studio Code Without Trac... by nneonneo on Saturday April 13, 2019 @01:52AM (#19651319)
I mean, I can definitely see “all other apps” being collected as a way to check if there are apps conflicting with or interfering with VSCode. Maybe it’s only collected for a small subset of users with particular issues - but it would still be tempting for a dev to try and collect.

I can also see them collecting code searches done within the app as a way to check if their search system is working well for real use-cases.

Neither is outside the realm of possibility - you just have to put yourself in the mindset of a dev who is assigned to track down a rare crash or to “improve the search experience” who might want a little more data to work with.

Not saying I agree with any of this collection - it’s terrible and definitely falls under “the road to hell is paved with good intentions”. Companies should be extremely clear about what they will and won’t collect - and never cross the line even if it would be useful.