Raspberry Pi OS automatically installing Microsoft repository

mitu

@greengriffon said in Raspberry Pi OS automatically installing Microsoft repository:

There wasn't. They snuck it in there without a word about what it's doing.

No, they didn't. It's part of the package's changelog:

pi@raspberrypi $ zless /usr/share/doc/raspberrypi-sys-mods/changelog.gz  | head -n 20

raspberrypi-sys-mods (20210125) buster; urgency=medium

  * Add Microsoft's VS Code repo on upgrade

 -- Serge Schneider <serge@raspberrypi.com>  Mon, 25 Jan 2021 16:03:24 +0000

It's a bit difficult to 'hide' something when it's open source.

GreenGriffon

@mitu Respectfully, that response ignores the actual issue. That line does nothing to inform the user as to what the package is actually doing.

mitu

@greengriffon said in Raspberry Pi OS automatically installing Microsoft repository:

That line does nothing to inform the user as to what the package is actually doing.

The package is not installed by default on upgrade - the user has to install it.

brandflake11

@greengriffon Hmm, what do you mean? It does tell you that it adds the VS Code repo.

GreenGriffon

@brandflake11 Telling you that VS Code is being added does not inform the user that MS has root-level access to your device and also pings their server.
I don't know how many times I can say the same thing.

mitu

@greengriffon said in Raspberry Pi OS automatically installing Microsoft repository:

elling you that VS Code is being added does not inform the user that MS has root-level access to your device and also pings their server.

How does MS have root access just because the VS COde repository has been added ?

brandflake11

@greengriffon Yeah the root access keys part I wrote is misleading, so I apologize for that. It just means that you have a key that trusts software from the repo automatically. So if you have the repo installed, and don't know about it, and something changes in the future, you could mistakingly install software from Microsoft that you may not want, say in an update.

GreenGriffon

@mitu said in Raspberry Pi OS automatically installing Microsoft repository:

How does MS have root access just because the VS COde repository has been added ?

I don't think you watched the video, or have followed any of the discussion on this issue.

brandflake11

I think a better solution to all of this would have been just making a build of VSCode available on Raspberry Pi's official repos. I would feel a lot safer than using one from Microsoft.

mitu

@greengriffon said in Raspberry Pi OS automatically installing Microsoft repository:

I don't think you watched the video, or have followed any of the discussion on this issue.

I didn't, because the title is a cheap click-bait. I know how apt/dpkg works and just adding the repository doesn't give Microsoft access to anything on your system.

@brandflake11 I think a better solution to all of this would have been just making a build of VSCode available on Raspberry Pi's official repos

Agree, I think that may happen after the responses on the Raspberry Pi forums.

brandflake11

Another thing I wanted to bring up: according to Wikipedia, the binaries of VSCode Microsoft builds are freeware, not MIT like the source code is. Here is the official VSCode EULA for more clarification. This is assuming that the builds on the repos are using these versions. If the builds are freeware, that does technically mean this is non-free software, doesn't it? It's kind of like Chrome vs Chromium, right?

mitu

Here is the official VSCode EULA for more clarification.

The page states that

This license applies to the Visual Studio Code product. Source Code for Visual Studio Code is available at https://github.com/Microsoft/vscode under the MIT license agreement at https://github.com/Microsoft/vscode/blob/master/LICENSE.txt.

This is assuming that the builds on the repos are using these versions. If the builds are freeware, that does technically mean this is non-free software, doesn't it? It's kind of like Chrome vs Chromium, right?

Yes, that could be the situation and the packages in the repo may be using some Microsoft bits that are not part of the official source repository.

brandflake11

@mitu This is a great clarification to know about and have here for users who may want to make their own choices regarding this.

mitu

@brandflake11 There's a vscode with the non-MS bits at https://github.com/VSCodium/vscodium. The differences (in license and distributed binaries) are explained in
https://github.com/Microsoft/vscode/issues/60#issuecomment-161792005

RedBatman

@brandflake11 LOL you beat me to it