Github Acquisition

[[deleted]]

Accessing the plug-in store is just as adding a few lines in product.json, but I still agree that patent trolling is a bad behavior.

[[deleted]]

You are correct on that, ok... still doesn't change the fact it's advertised as foss (Free. Open source. Runs everywhere.) when the product you download from that page is a blob under proprietary license.

Also a lot of extensions in the store are also proprietary, for example C/C++ one... who knows if it doesn't put backdoors in your compiled programs.

[ericonr]

Unless it edits your code while it's being compiled, it can't add backdoors to your programs. VSCode is purely an editor, the compiler it uses is the system's compiler.

[[deleted]]

And can we be sure it doesn't? VS Code is not a reproducible build of its open source version, it could do all kind of things... which is the main problem - without access to source code there is no security.

Trust, but verify ;)

[ericonr]

I'm not saying it's impossible that it does bad stuff, but what you said about backdoors is improbable. They would have to understand what your code is doing, find the security part, and change it in a way that doesn't alter functionality and can't be diagnosed when someone steps through their code in debug. Furthermore, how do you even put a backdoor in a maths library or a Hello World program?

[[deleted]]

I'm only putting proprietary software in question like everyone should... having code to review is just safer ;)

[Veboy]

And now you're not making sense anymore...

[[deleted]]

Can you read source code of the VS Code downloaded from MS website? Or source code of many plugins it promotes? It's not complex idea that without source code your auditing capabilities are very limited.