Hacker News new | ask | show | jobs
by gdmka 2200 days ago
>>I have zero personal information in the IDE and all the code I work on is already in the public domain with an open source license, so why should I care?

Off the top of my head: API tokens and other credentials that live right in the file while you develop and debug.

Those are quite sensitive. To put more wight on the issue[0]

[0] https://medium.com/@stestagg/stealing-secrets-from-developer...
1 comments
mekster 2200 days ago
Since when does the telemetry even send out any contents of any files?

That's called stealing not telemetry.

link
Silhouette 2200 days ago
Since when does the telemetry even send out any contents of any files?

Since pretty much forever? At the very least, many programs with built-in telemetry have included things like memory dumps of key areas at the time of a crash, which could include data the user was working on at the time.

More seriously, I invite you to read Microsoft's extensive privacy policies and try to satisfy yourself that they don't grant themselves the right to upload your code. They are sufficiently nebulous and ambiguous that they could probably be interpreted that way.

link
_nilt 2200 days ago
>> Since when does the telemetry even send out any contents of any files?

To me it's not evident otherwise until i'm capable of observing bare data itself. Not obfuscated, not in some proprietary format to secure it in-transport but the raw stuff. MS states there's no reliable way to let people see the data being collected (even under GDPR) as there's no sing-in experience provided.[0]

While a part of the statement is true, most of privacy conscious VSC users aware that every installation of the product has a unique `machineId` property. Can be located at Output -> Log (Shared).

The [0] provides some elaboration:

"We do send information that helps us approximate a single user for diagnostic purposes (this is based on a hash of the network adapter NIC) but this is not guaranteed to be unique. For example, virtual machines (VMs) often rotate NIC IDs or allocate from a pool. This technique is sufficient to help us when working through problems, but it is not reliable enough for us to 'provide your data'."

So, given the premise the user can be identified by a NIC plus a machineId (which looks to be an UUID) — it's easy to get access to collected data. As soon as ability to verify no really critical data is collected, i'll switch back from VSCodium.

[0]https://code.visualstudio.com/docs/getstarted/telemetry

link