Absolute ignorance of telemetry issues by VSCodium team.

[megastallman]

Describe the bug
No one cares about telemetry found, and no one is even about to accept a telemetry hostname provided in #623 (comment)
Just add ticino.blob.core.windows.net to undo_telemetry.sh. I'm waiting for 3 months, and no one even noticed this issue.

Another problem is, that many people still believe that VSCodium removes telemetry, even though - it doesn't. So, false promises. Btw, there is a line, saying "Telemetry is disabled." on vscodium.com. Why are you lying?

Telemetry options are enabled by default... Nice!

However, there is also a bunch of leaks to open-vsx.org, that are intentionally ignored by the team.

Expected behavior
I expect VSCodium NOT connecting anywhere when not asked to. Also I expect the developers to fix the issues found.
Guys, the problems don't disappear, unless they are resolved.

Desktop (please complete the following information):

• OS: Xubuntu 20.04
• Architecture: x64
• Version: all

[nukeop]

open-vsx.org is not a telemetry domain, it's an extension store

[daiyam]

@megastallman Any help is welcome. I recommend you to make a PR if you find something missing.

For ticino.blob.core.windows.net, it's used by the debugger to load the source maps of the builtin extensions.

• Is it telemetry? I don't know
• Should it be blocked? Maybe. I personally block it with my firewall.

[megastallman]

Thanks @daiyam for reaching out!
To trigger ticino.blob.core.windows.net - just run debug tools in VSCodium. When I get back to my build procedure, I'll post that pull-request.

As for open-vsx.org - it really needs fixed. An IDE should not ping it at any single action. More, I need a possibility to just disable any outside calls and get a silent program. It should not call home all the time.

[concaam]

Addressed to @megastallman

I was interested in VSCodium because I wanted Visual Studio Code's functionality without telemetry for Julia programming. They even have a great extension called "julia-vscode"... It was a great idea to visit the issues page and see issues like #623 and this one appear.

The webmasters should remove promising phrases like "Telemetry is disabled.", if they are proven to be false.

Thanks for your research, or otherwise I would've used VSCodium and not other alternatives like Vim, Emacs, Atom etc.

Cheers

[concaam]

Addressed to @megastallman

I was interested in VSCodium because I wanted Visual Studio Code's functionality without telemetry for Julia programming. They even have a great extension called "julia-vscode"... It was a great idea to visit the issues page and see issues like #623 and this one appear.

The webmasters should remove promising phrases like "Telemetry is disabled.", if they are proven to be false.

Thanks for your research, or otherwise I would've used VSCodium and not other alternatives like Vim, Emacs, Atom etc.

Cheers

To clarify, this does not mean that someone should or should not use VSCodium, but for me specifically that this does not get fixed (#623 was created at 31.01.2021) is unacceptable.

[concaam]

open-vsx.org is not a telemetry domain, it's an extension store

It seems to be the Open VSX Registry.
Looking at issue #372, it looks like VSCodium connects to open-vsx.org for integrating with the Open VSX Registry.

Thanks @daiyam for reaching out!
To trigger ticino.blob.core.windows.net - just run debug tools in VSCodium. When I get back to my build procedure, I'll post that pull-request.

As for open-vsx.org - it really needs fixed. An IDE should not ping it at any single action. More, I need a possibility to just disable any outside calls and get a silent program. It should not call home all the time.

There seems to be no legitimate interest to connect to open-vsx.org,
when just initializing and then editing files with VSCodium.

There should be an opt-out option in the settings like "Ask before connecting to open-svx.org when not using the extensions functionaliy?". The default opt-out option is "Ask", the others are "Forbid" and "Allow".

Or even better, just forbid out-going connections to open-svx.org, when the end-user does not use the extensions store or anything which would require to connect to the domain. If the extensions page, or whatever it's called, is active and in focus (meaning that the mouse cursor is inside the page), then allow it. Afterwards, when out of focus block it again (default).

Of course, instead of writing the domain in the settings text, which could change in the future, we can just use "Open SVX Registry".

Cheers

[nukeop]

Or even better, just forbid out-going connections to open-svx.org, when the end-user does not use the extensions store or anything which would require to connect to the domain.

Why on Earth would they waste time implementing that?

[concaam]

Or even better, just forbid out-going connections to open-svx.org, when the end-user does not use the extensions store or anything which would require to connect to the domain.

Why on Earth would they waste time implementing that?

Because if I would be okay with that I could just visit Microsoft's vscode repo and build it myself manually without this out-going connection?

I understand, you may not agree with my views regarding privacy policies and its enforcement, and that is fine, however do you not at least agree that it is hypocritical when the website states that "telemetry is disabled" and right there it just connects to a domain from a "Extensions Registry" when I do not even expect it and want it to do it.

It's like buying a smart tv which advertises privacy for its users, but then it turns out that some connections still go out. So, instead of 93 out-going connections per hour, it would, for example, have 12. When switching channels there are 0, but when it awakes from standby and you change volume, the connections are still there. So telemetry is not "disabled", it's "minimized". You know what I mean?

That, in my opinion, are low standards, meaning that the sense of this project goes away and away, the more stuff like this happens and gets detected by someone.

Cheers

[nukeop]

It's not telemetry, and it's not Microsoft's domain.

[daiyam]

@concaam Feel free to make any PR for the change you would like 😉

[concaam]

It's not telemetry, and it's not Microsoft's domain.

"it's not Microsoft's domain" That would make sense, because open-vsx.org seems to be from the Eclipse Foundation.

"It's not telemetry" Please describe exactly what you define under telemetry.

"In software, telemetry is used to gather data on the use and performance of applications and application components, e.g. how often certain features are used, measurements of start-up time and processing time, hardware, application crashes, and general usage statistics and/or user behavior. In some cases, very detailed data is reported like individual window metrics, counts of used features, and individual function timings.

This kind of telemetry can be essential to software developers to receive data from a wide variety of endpoints that can't possibly all be tested in-house, as well as getting data on the popularity of certain features and whether they should be given priority or be considered for removal. Due to concerns about privacy since software telemetry can easily be used to profile users, telemetry in user software is often user choice, commonly presented as an opt-in feature (requiring explicit user action to enable it) or user choice during the software installation process. " - https://en.wikipedia.org/wiki/Telemetry#Software

Pushed code which seems to change the "extensions gallery" url from https://marketplace.visualstudio.com/_apis/public/gallery to
https://open-vsx.org/vscode/gallery: PR 34aa7b0

Cheers

[concaam]

@concaam Feel free to make any PR for the change you would like 😉

I agree, that would be helpful. As already mentioned here:

Pushed code which seems to change the "extensions gallery" url from https://marketplace.visualstudio.com/_apis/public/gallery to
https://open-vsx.org/vscode/gallery: PR 34aa7b0

Assuming that vscode connects to that domain by default on startup when not using any extensions related, a "firewall" option switch like "Ask", "Allow" and "Forbid" idea as mentioned here:

There should be an opt-out option in the settings like "Ask before connecting to open-svx.org when not using the extensions functionaliy?". The default opt-out option is "Ask", the others are "Forbid" and "Allow".

And a straight "forbid it, until it would be required, to integrate with the Open VSX Registry" idea:

Or even better, just forbid out-going connections to open-svx.org, when the end-user does not use the extensions store or anything which would require to connect to the domain. If the extensions page, or whatever it's called, is active and in focus (meaning that the mouse cursor is inside the page), then allow it. Afterwards, when out of focus block it again (default).

Of course, instead of writing the domain in the settings text, which could change in the future, we can just use "Open SVX Registry".

What is your opinion on these two ideas?

Cheers

[howlger]

This issue violates the project's Code of Conduct and therefore should be deleted.

The issue is based on the false fact that the Open VSX Registry would be telemetry. This is not true, as stated in the first comment by @nukeop. Since both, VSCodium and the Open VSX Registry are open source, it would be easy to find out what data is being transmitted for what reason. It's not okay to imply others don't care about privacy (I would assume the opposite; why else would one be here?), nor does it add value without saying what telemetry data is collected or how privacy is violated by requesting the Open VSX Registry via HTTPS.

[daiyam]

While I agree the original post was lacking of tact, borderline rude (main reason I've not replied immediately and that we are supporting this project on our free time). I understand that some people won't like any connection to be made. This is why I've encouraged them to make any PR as they see fit.

[Chaostheorie]

@concaam would you be willing to make a PR with the relevant changes? As @howlger already mentioned, the Open VSX Registry is not telemetry and instead just the extension store that will most likely be pinged assuming you have auto-updates for extensions enabled.

But your (second?) argument against the possible telemetry with ticino.blob.core.windows.net when using the devtools seems valid. As @daiyam encouraged you, make a PR. If you're not willing to change it yourself, either just start with a PR or find someone, who's willing to open the PR for you.

I'm pretty sure there will be some people willing to help you, if you attempt to make the changes yourself, but it would help if you listen to their arguments and respect the Code of Conduct. I support your move against any contact to MS for VSCodium but this discussion will otherwise just get stuck.

[pmahend1]

I always assumed telemetry is off on VS Codium by default. Reading description I thought there was an Open PR.

[Chaostheorie]

@pmahend1 at least for my build (1.58.0 / paulcarroty.gitlab.io/vscodium-deb-rpm-repo) that's correct. Telemetry: Enable Telemetry and Telemetry: Enable Crash Reports is false by default.

The initial problem was AFAIK about vscodium contacting the extension store automatically, presumably to check for updates of extensions, and a ping to a MS domain when opening the builtin devtools.

[daiyam]

@pmahend1 @Chaostheorie vscodium is disabling the telemetry by default, and is replacing the telemetry domains (dc.services.visualstudio.com and vortex.data.microsoft.com) with the ip 0.0.0.0. So even if the telemetry is on, it won't able to send the data to those domains.

[Chaostheorie]

@daiyam Thank you for the explanation. That seems like very reasonable defaults.

[pmahend1]

@daiyam thank you for reconfirming.
This issue can be closed then.

[daiyam]

@megastallman Do you plan to make a PR to add an option so VSCodium don't make any connection?

[megastallman]

@concaam , please check my project: https://gitlab.com/megastallman/uncoded
It is a very simple VSCode OSS rebuild without any telemetry I coud find in VSCodium. It partially forks a couple of VSCodiums scripts and finally provides a silent VSCode OSS install, that just doesn't phone home. Including those "not a telemetry domains" like openvsx registry, that also accepts telemetry on every move(due to the code).

As for @daiyam @howlger - guys, you know... Your lies about "Telemetry is disabled." don't violate the CoCk. But when someone accuses you in those lies - it does. So, I have zero to no intent to cooperate with you, at least until you stop threatening me with you CoC, thanks!

[daiyam]

@megastallman As I stated, you are free to make PR if you find you did miss something.

Also being politeness won't kill you 😉