I mean, you can say whatever you want - you only diminish your own argument by doing so. It's like the boy who cried wolf - if you keep shouting "spyware" with no true evidence of spyware, then by the time that "spyware" actually is happening, no one is going to care.

> what it either does now

Spyware is defined (Google) as "a form of malware that hides on your device, monitors your activity, and steals sensitive information like bank details and passwords." Please furnish any example of Microsoft stealing sensitive information like bank details and passwords via VSCode.

> perhaps is reasonably likely to do at some time in the future

An imagined hypothetical does not help your argument.

> Spyware is defined (Google) as "a form of malware that hides on your device, monitors your activity, and steals sensitive information like bank details and passwords." Please furnish any example of Microsoft stealing sensitive information like bank details and passwords via VSCode.

Well, yes, of course Google would say that. If you ask DuckDuckGo to define spyware, it offers these:

> Software that secretly gathers information about a person or organization.

> programs that surreptitiously monitor and report the actions of a computer user.

Which of course is exactly what VSC does.

That's wrong. They key element of "spyware" is that it monitors and reports outside of it's own realm, and cause damage with the data. Like a keylogger logs keys even it's not the active program. What VSCode does is only monitoring user action within VSCode for technicality. Until you can provide evidence otherwise, calling it "spyware" is act of defamation.

Also, if software with telemetry is spyware, there is no mainstream browser clean. Feel free to use forks like Tor Browser or VSCodium if you like, but expanding the scope of spyware unreasonably only gonna cause confusion to average people.

It's not "expanding the scope," it's clarifying (or developing) a definition.

And if it causes confusion -- good. There should be more public confusion on this topic, especially in the realm of "Why does this free program need to know all of this stuff about what I'm doing?"

It's not that answer is "no gathering information ever," it's "providers of a program ought to be compelled to fully and clearly disclose to all what information it is grabbing and what it is doing with it."

And that's emphatically not where we live today.

Even the FTC struggles to define spyware. But I think you’re right that a disagreement on the definition is at the heart of all of this. I wouldn’t be so overconfident in asserting that spyware is defined in your particular way here, though. There isn’t exactly a consensus! VSCode is certainly not to be lumped in with password stealing keyloggers, but because they continue collecting telemetry data even after you explicitly disable it, VSCode does fall under the “collecting data without a user’s knowledge” category of spyware.

I'm very comfortable calling ALL OF IT spyware until something like the GDPR cookie thing exists for it. (or they voluntarily make such a statement BEFORE you use it)

Calling spyware an "imagined hypothetical" re Microsoft is like calling "too hot coffee" an "imagined hypothetical" for McDonalds.

They've already done it a bunch. Are you naive enough to 100% believe their pinky swears?

Sure, let’s have any example of this by any reputable news source then.

literally the first hit for "microsoft spyware" is the following:

https://www.gnu.org/proprietary/malware-microsoft.en.html

gnu.org not reputable? Hey, no worries, it's an ENORMOUS ANNOTATED list. Have fun.

We're not talking about MS the company, we're talking about VSCode, the product, as OP's claim was that it's apparently well-known that VSCode is spyware. Ctrl-F "VSCode", "Visual Studio" both come up with 0 results.

It hasn't in the past, but because it is a Microsoft product, you would be wildly naive to think that they wouldn't have a tendency to in the future. You're technically correct in the most pointless way possible.

OP claimed vscode is “spyware-ridden”. It is not.

I have a tangental concern, which is that all things microsoft these days seem to be evolving towards an advertising platform or a subscription. The way they keep adding integrations into their other stuff is understandable, and doubtless convenient for many people, but I can't help but think that someday after they are deeply embedded in the workflows of large swaths of the development community a message will appear in your editor suggesting an upgrade to the pro version of some tool or plugin and the freemium experience will have arrived.

Lots of big tech companies (including mine) let their devs run VSCode on company machines. If there was a concern about spyware, I feel like all of those security teams across the industry wouldn't have signed off on this, especially with billions of dollars of IP at stake.

Like log4j!

I think there's a bit of a difference between a bug that went undiscovered for years and vetting third-party software to see if its telemetry compromises your employees or IP.

I mean, sure, if you want to avoid log4j from happening, you can write all of your software from the ground up in-house with no third party dependencies (or audit every line of code for every third-party program you do use), but I don't see how that's relevant to a discussion about whether VSCode is compromised to a degree that other editors aren't.

The point was that people thought "Oh surely log4j was vetted by the big companies that depend on it - I mean it must be OK if AcmeCorp uses it!". (or openssl, or sendmail, or ...). That's not too different from "Oh look at all these big tech companies using it, they must have vetted the telemetry".

Maybe a little extra caution is warranted.