Raspberry Pi OS Accused of 'Phoning Home' To Microsoft


Linux-SWAT

Linux-SWAT

Forum Addict!
Joined
Feb 13, 2010
Messages
9,188
slashdot.org

Raspberry Pi OS Accused of 'Phoning Home' To Microsoft - Slashdot

Slashdot reader rushtobugment quotes a story from Hot Hardware: One of the software options for running a Raspberry Pi module is Raspberry Pi OS (formerly Raspbian), the officially supported Debian-based operating system put out by The Raspberry Pi Foundation. It has been around since 2015...
slashdot.org
 
After reading your comment I did update on my raspios, this is what I have now
Code: 
┌─[pi] (08:21 AM)-(Sun Feb 07) !976! [~]
└───▶ cat /etc/apt/sources.list.d/
raspi.list   vscode.list  

┌─[pi] (08:21 AM)-(Sun Feb 07) !976! [~]
└───▶ cat /etc/apt/sources.list.d/vscode.list 
### THIS FILE IS AUTOMATICALLY CONFIGURED ###
# You may comment out this entry, but any other modifications may be lost.
deb [arch=amd64,arm64,armhf] http://packages.microsoft.com/repos/code stable main
For now I am going to uncomment this repo. But I will try to find out more about this.
 
Will the next update add that line back in?
It's been suggested to touch the vscode file so it's empty and then set it to read-only

Apart from that I heard concerns about an MS certificate. I know next to nothing about this. Maybe someone can elaborate.
 
Probably not a certificate. Probably a public key, if package signing works in a similar way to how it does in arch at least. In arch, the package manager (pacman) maintains it's own gpg key file in /etc/pacman.d/gnupg and by using gpg --homedir=/etc/pacman.d/gnupg you can administer it using the standard gpg commands, such as --list-keys to see what public keys it contains.

Edit: It might be a certificate also if it uses https to connect, and that's using a nonstandard certificate. I'd expect those to be under /usr/share/cacertificates/trust-source or somewhere similar.
 
kuru said:
Will the next update add that line back in?
It's been suggested to touch the vscode file so it's empty and then set it to read-only

Apart from that I heard concerns about an MS certificate. I know next to nothing about this. Maybe someone can elaborate.
Click to expand...
I guess not. What I think is Team Pie has done this so that users can easily install some micorosoft applications using apt-get without needing to manually add repos. ( I don't agree with their way of doing this though). But once that line is commented out, it shall stay that way. However I don't fully trust them now and, I will check that manually again after every updates.
I am not sure making vscode file read-only is foolproof, as package managers can replace anyfile while running as root. So even after that manually checking the repos will be required.
 
docbroke said:
I guess not. What I think is Team Pie has done this so that users can easily install some micorosoft applications using apt-get without needing to manually add repos. ( I don't agree with their way of doing this though). But once that line is commented out, it shall stay that way. However I don't fully trust them now and, I will check that manually again after every updates.
I am not sure making vscode file read-only is foolproof, as package managers can replace anyfile while running as root. So even after that manually checking the repos will be required.
Click to expand...
From what I understand they could have just installed VSCodium
Post automatically merged:

Seems too much like embrace, extend, extinguish
 
I don't know a great deal about this so correct me if I'm wrong. What's with Raspian that your repos aren't just a list of urls that you can comment and uncomment at will? Having config files that create config files that create config files is some Grub-like BS and is the primary reason I got rid of Grub, it's such bad design. (I really hate Grub, long live systemd-boot!)

Is it because they think Pi users are unlikely to be tech savvy enough to maintain a mirrorlist, so they take away your freedom in the name of perceived convenience? So they don't let you pick where you get your software from? Is this behaviour in Debian as well?

Sounds like an obligatory posting of the https://www.reddit.com/r/StallmanWasRight/ url is in order.
 
I think there is a genuinely tricky problem here. Pretty much all FOSS enthusiasts would agree that the long-term goal is to put open-source code everywhere. to make it possible for anyone, buying any sort of computer, to modify, audit, and maintain it themselves. Crucially, that means engaging with businesses that are not by, of or for ideological purists.

In the last twenty years, there's been huge progress in that all sorts of consumer systems run mostly-ish-open software. Linux & Android have become the obvious choice for embedded and mobile computing. Chrome and its family have utterly displaced IE from the browser market. You don't need Flash to run web applications any more. The biggest businesses in the industry are all contributing to OpenStreetMap.

Of all implausible things, Microsoft are releasing their software as Debian packages for ARM!

Sadly, all that headway has come at the cost of purity. When big companies release open or FOSS-compatible software, they are lazy and selfish. They try to duck out of obligations, and do a shoddy job of documentation.

While we should absolutely support those few who take software freedom seriously, I think I would rather have corrupt half-hearted FOSS than the entirely proprietary alternative. It's the difference between running a few non-free blobs on your Ubuntu machine, and having to use Windows for compatibility with the outside world.

I know which I prefer!
 
kaprikawn said:
Is it because they think Pi users are unlikely to be tech savvy enough to maintain a mirrorlist, so they take away your freedom in the name of perceived convenience? So they don't let you pick where you get your software from? Is this behaviour in Debian as well?
Click to expand...
No. In Debian you list your repository urls in /etc/apt/sources.list, and if you want you can configure pinning and fancier policies in files nearby, but debian won't change it without telling you.
All package managers take their sources from etc/apt/sources.list and that's it (you may have to add gpg keys with apt-key add if your repositories don't use the Debian signing keys).
Some GUI package manager may have dialogs to edit the sources but they just edit that file behind the scenes with what you put in the dialog.
In fact there's also /etc/apt/sources-list.d/ . I've never used but I guess that's easier for automated source management.
In any case I've never heard of Debian itself adding repositories to configurations without asking the admin. Sounds crazy to me.

@Binky, I wish I could share your optimism, but I disagree. There was a time when running 100% free software was an option, Now it's increasingly difficult, with systems needing blobs for network, wiki, gpu, DRAM controller, boot blocks and what not. The fact that companies are contributing to free software is in principle good, but there're many different cases. Sometimes is just greenwashing, sometimes it's opencore, and at other times it just makes it more difficult for volunteers to keep up with development pace, so the code is free (which is still good) but bloated, the governance is "we don't care", and the informal auditing is dubious. Other cases are just great. So yes, we have quantitatively more free software but qualitatively is maybe not so rosy. And effectively it's like being given a virtual box to play with free software in, but the vendors keeping control of your hardware. I can't help thinking if the public would take freedom more seriously we might have a little fewer projects but more useful and we'd be more free. Is not the general public at least there should be a niche market of pure freedom respecting computing (a little like bio food, which isn't the biggest part of the market but at least thrives and offers an option for those who want it - and can get it). And don't get me started on SaaS.
 
Binky said:
I think there is a genuinely tricky problem here. Pretty much all FOSS enthusiasts would agree that the long-term goal is to put open-source code everywhere. to make it possible for anyone, buying any sort of computer, to modify, audit, and maintain it themselves. Crucially, that means engaging with businesses that are not by, of or for ideological purists.

In the last twenty years, there's been huge progress in that all sorts of consumer systems run mostly-ish-open software. Linux & Android have become the obvious choice for embedded and mobile computing. Chrome and its family have utterly displaced IE from the browser market. You don't need Flash to run web applications any more. The biggest businesses in the industry are all contributing to OpenStreetMap.

Of all implausible things, Microsoft are releasing their software as Debian packages for ARM!

Sadly, all that headway has come at the cost of purity. When big companies release open or FOSS-compatible software, they are lazy and selfish. They try to duck out of obligations, and do a shoddy job of documentation.
Click to expand...
VS Code isn't open source, at least last time I heard. It's been built and released for linux, but the source isn't available. It's a binary blob, same as all other debs, just this isn't backed by a source release. And on top of that they didn't release the binaries to the raspberry pi os team, but instead set up their own repo, which has lead to these calls of the software phoning home.
 
levi said:
VS Code isn't open source, at least last time I heard. It's been built and released for linux, but the source isn't available. It's a binary blob, same as all other debs, just this isn't backed by a source release. And on top of that they didn't release the binaries to the raspberry pi os team, but instead set up their own repo, which has lead to these calls of the software phoning home.
Click to expand...
github.com

GitHub - microsoft/vscode: Visual Studio Code

Visual Studio Code. Contribute to microsoft/vscode development by creating an account on GitHub.
github.com github.com
 
pmprog said:
Sure it is, that's why VSCodium exists as a telemetry-removed build of VSCode.

Edit: I say "remove", but it's more "disabled"

URL for Ref:
Code: 
https://vscodium.com/
Click to expand...
Read more like 'unconfigured' to me. Presumably the build you download using the microsoft repo on Raspberry Pi OS has all of the telemetry configured and is running, so to my mind that makes this less free than a debian derived OS ought to be.
 
ptitSeb said:
Of course telemetry is enabled in MS build, it's the vanilla build of VSCode

code.visualstudio.com

Visual Studio Code Telemetry

Learn about Visual Studio Code collected telemetry and how to opt out.
code.visualstudio.com code.visualstudio.com

This is just the standard allergic reaction to seeing MS name associated with Linux.
Click to expand...
exactly this.
I think this is rather a discussion about what MS could do, than what they do. I don't like automatically adding lines to my sources list either, but I can understand the reason. If someone is new to Linux, messing with the sources list is not something that I would recommend, but the Raspberry Pi is a platform to attract new people to linux. For them, this solution just works.
VS is a great tool and the alternatives are just not really comfortable in my opinion. Making VS open source is a great step from Microsoft and a sign that they start loosing the battle.
The desktop is the last resort for Microsoft right now, besides VR. Linux, especially with the raspberry pi, is attacking this last field rather aggressively lately. On other places like mobile they have lost the battle a long time ago.
I don't think they let people upgrade their PCs to windows 10 for free just for fun. They can't risk loosing another customer in my opinion.
 
ClockworkCoder said:
VS Codium is a fantastic alternative, in a similar way to Chromium over Chrome.
Click to expand...
Yes and no. There is a major difference: Chrome is not opensource, Chormium is. And Chrome is based on Chromium.
where
VSCode is already opensource, and so is VSCodium. And VSCodium is based on VSCode.
 
ptitSeb said:
Yes and no. There is a major difference: Chrome is not opensource, Chormium is. And Chrome is based on Chromium.
where
VSCode is already opensource, and so is VSCodium. And VSCodium is based on VSCode.
Click to expand...
Fair points. I meant more in terms of the telemetry.

I think it would have been better to allow VSCode to be installed as an optional extra, at least allow users to make an informed choice on their own than secretly add it.
 
You must log in or register to reply here.

Similar threads

rSl
Raspberry Pi 400 desktop PC
2
Replies
21
Views
5K
FBnil
FBnil
F
Pandora Help with running pandora applications on the raspberry pi 2
Replies
9
Views
6K
rygD
rygD
Delightful Dude
Raspberry Pi 4 released
2 3
Replies
56
Views
11K
Inqui
Inqui
Wally
Pyra and Raspberry Pi?
2 3 4
Replies
65
Views
17K
Grench
Grench
Jones
Mobile Raspberry Pi Computer
2
Replies
26
Views
6K
2bit
2bit
Back
Top