Raspberry Pi OS automatically installing Microsoft repository

brandflake11

I just saw this video

from TLG where Gardiner explains that a Microsoft Repository with trusted software gpg keys are getting installed on Raspberry Pi OS. What do you all think of this? I don't like the idea of this, I try to stay away from proprietary software in my Linux builds, and I don't like the idea of giving Microsoft any pings when I update. Here's an article on it too!

Also, does Retropie automatically inherit this? What are you all's thoughts on this?

mitu

@brandflake11 said in Raspberry Pi OS automatically installing Microsoft repository:

Also, does Retropie automatically inherit this? What are you all's thoughts on this?

It's an upstream (Raspberry Pi OS) decision and I don't see why it's such a big deal. It's just a 3rd party repository for the installation of Visual Studio Code, used to delevelop code for the newly released RPi Pico MCU.

The software provided is not proprietary, it's open source - https://github.com/Microsoft/vscode.

brandflake11

@mitu said in Raspberry Pi OS automatically installing Microsoft repository:

@brandflake11 said in Raspberry Pi OS automatically installing Microsoft repository:

Also, does Retropie automatically inherit this? What are you all's thoughts on this?

It's an upstream (Raspberry Pi OS) decision and I don't see why it's such a big deal. It's just a 3rd party repository for the installation of Visual Studio Code, used to delevelop code for the newly released RPi Pico MCU.

The software provided is not proprietary, it's open source - https://github.com/Microsoft/vscode.

I think for me, I don't want to support what Microsoft does. It may be open source, but I just don't trust or condone what they do to users and technology. I don't want to even give them the benefit of pings to their Linux repo. I don't want any software that comes from that repo. Other users will have their own reasons I'm sure if they don't like it.

I think the fact that they added this to Raspberry Pi OS is reason for me to change distros, which is okay. I had a certain amount of trust that the distro shared similar values to me, but they have diverged now. I'd be curious to hear what others have to say too.

mitu

@brandflake11 said in Raspberry Pi OS automatically installing Microsoft repository:

I think the fact that they added this to Raspberry Pi OS is reason for me to change distros, which is okay. I had a certain amount of trust that the distro shared similar values to me, but they have diverged now. I'd be curious to hear what others have to say too.

Feel free to disable/delete the repository, but we don't support other distro on the Pi besides Raspberry Pi OS.

brandflake11

@mitu Sure thing. It's good that users know about this added repository, in case they want to get rid of it.

GreenGriffon

@brandflake11 I think if this were as harmless or "not a big deal" as some people want to make it seem, there would have been transparency surrounding its inclusion in the distro.
There wasn't. They snuck it in there with root-level permissions, without a word about what it's doing.
Shady as hell.

mitu

@greengriffon said in Raspberry Pi OS automatically installing Microsoft repository:

There wasn't. They snuck it in there without a word about what it's doing.

No, they didn't. It's part of the package's changelog:

pi@raspberrypi $ zless /usr/share/doc/raspberrypi-sys-mods/changelog.gz  | head -n 20

raspberrypi-sys-mods (20210125) buster; urgency=medium

  * Add Microsoft's VS Code repo on upgrade

 -- Serge Schneider <serge@raspberrypi.com>  Mon, 25 Jan 2021 16:03:24 +0000

It's a bit difficult to 'hide' something when it's open source.

GreenGriffon

@mitu Respectfully, that response ignores the actual issue. That line does nothing to inform the user as to what the package is actually doing.

mitu

@greengriffon said in Raspberry Pi OS automatically installing Microsoft repository:

That line does nothing to inform the user as to what the package is actually doing.

The package is not installed by default on upgrade - the user has to install it.

brandflake11

@greengriffon Hmm, what do you mean? It does tell you that it adds the VS Code repo.

GreenGriffon

@brandflake11 Telling you that VS Code is being added does not inform the user that MS has root-level access to your device and also pings their server.
I don't know how many times I can say the same thing.

mitu

@greengriffon said in Raspberry Pi OS automatically installing Microsoft repository:

elling you that VS Code is being added does not inform the user that MS has root-level access to your device and also pings their server.

How does MS have root access just because the VS COde repository has been added ?

brandflake11

@greengriffon Yeah the root access keys part I wrote is misleading, so I apologize for that. It just means that you have a key that trusts software from the repo automatically. So if you have the repo installed, and don't know about it, and something changes in the future, you could mistakingly install software from Microsoft that you may not want, say in an update.

GreenGriffon

@mitu said in Raspberry Pi OS automatically installing Microsoft repository:

How does MS have root access just because the VS COde repository has been added ?

I don't think you watched the video, or have followed any of the discussion on this issue.

brandflake11

I think a better solution to all of this would have been just making a build of VSCode available on Raspberry Pi's official repos. I would feel a lot safer than using one from Microsoft.

mitu

@greengriffon said in Raspberry Pi OS automatically installing Microsoft repository:

I don't think you watched the video, or have followed any of the discussion on this issue.

I didn't, because the title is a cheap click-bait. I know how apt/dpkg works and just adding the repository doesn't give Microsoft access to anything on your system.

@brandflake11 I think a better solution to all of this would have been just making a build of VSCode available on Raspberry Pi's official repos

Agree, I think that may happen after the responses on the Raspberry Pi forums.

brandflake11

Another thing I wanted to bring up: according to Wikipedia, the binaries of VSCode Microsoft builds are freeware, not MIT like the source code is. Here is the official VSCode EULA for more clarification. This is assuming that the builds on the repos are using these versions. If the builds are freeware, that does technically mean this is non-free software, doesn't it? It's kind of like Chrome vs Chromium, right?

mitu

Here is the official VSCode EULA for more clarification.

The page states that

This license applies to the Visual Studio Code product. Source Code for Visual Studio Code is available at https://github.com/Microsoft/vscode under the MIT license agreement at https://github.com/Microsoft/vscode/blob/master/LICENSE.txt.

This is assuming that the builds on the repos are using these versions. If the builds are freeware, that does technically mean this is non-free software, doesn't it? It's kind of like Chrome vs Chromium, right?

Yes, that could be the situation and the packages in the repo may be using some Microsoft bits that are not part of the official source repository.

brandflake11

@mitu This is a great clarification to know about and have here for users who may want to make their own choices regarding this.

mitu

@brandflake11 There's a vscode with the non-MS bits at https://github.com/VSCodium/vscodium. The differences (in license and distributed binaries) are explained in
https://github.com/Microsoft/vscode/issues/60#issuecomment-161792005