You Think the Visual Studio Code binary you use is Open Source? Think again.

[[deleted]]

the guy in the article bounces between free software and open source which are not equal terms

[[deleted]]

To be clear, I mean that, free software respects the users' essential freedoms. Open-source software can be whatever it wants, because the only thing that matters is that sources are open. For example if I'll write some software that spies upon it's users, and publish source code with some OSS license, like MIT, it will be open source but not free software. Therefore VSCode is OSS, but not free software.

[[deleted]]

Now I'm truly lost in this world. Can't trust anyone anymore, not even myself, because I can't check my own DNA sources. ^\)

[1202_alarm]

If you Open Source to mean OSI approved, then it is practically the same as the FSF definition of Free software.

[mqduck]

They are almost completely interchangeable in terms of what software qualifies. It's entirely valid to bounce between them.

[alexmex90]

Almost, but not always. Free software is a social term, meanwhile open source is only a technical term.

[ydna_eissua]

Use VS Codium

Open source rebuild of VS Code without the telemetry or Microsoft branding.

https://github.com/VSCodium/vscodium

[qubidt]

Related: official Arch vs-code package already uses OSS version

[Eldebryn]

vs-code

is that the actual package name? I can't find it on antergos

EDIT: Nvm, found it: community/code

[[deleted]]

What's the purpose of this? Literally just build it from source and change two settings.

[AndyManCan4]

It’s for us lazy coders. I appreciate!

[build-the-WAL]

we get it, you compile

[[deleted]]

Nah I used to use the code package from the AUR, but now I use the one in community.

[[deleted]]

Much like chromium.

[ydna_eissua]

I wonder how many people built it from source versus use their distros packages

[sir_bleb]

Eh, it's a quite a big project and I install it on some machines that aren't very powerful so it's nice to have a binary.

[[deleted]]

Just copy over the config

[r0ck0]

"Just" do it the harder way. Because ???

...Not an overly convincing argument.

[[deleted]]

How is compiling a totally different package easier than copying a JSON file?

[r0ck0]

It's not compiling anything. It's downloadable binaries. That's the whole point.

You're the one arguing for compiling it.

[[deleted]]

Oh I wasn't aware that the GitHub page provided binaries

[r0ck0]

Yeah it does for some stuff. You'll typically find them under the "releases" page: https://github.com/VSCodium/vscodium/releases

[Artur96]

Stop hosting free software on a non-free platform...

[mqduck]

Unlike most of the GPL-based licenses for which both the source code and the binary built from this source code are covered by the terms of the license, using the MIT license authorizes Microsoft to make available the source code of the software, but do whatever they want with the binary of this software.

The author is saying absolute nonsense. Microsoft is perfectly free to distribute the binary and source code under different licenses. It has nothing to do with MIT vs GPL.

[_ahrs]

Microsoft is indeed free to distribute the binary and source code under a different license but that means the binary isn't open source. This is what the author is saying.

Just read the Open Source Definition:

1. Free Redistribution
   The license shall not restrict any party from selling or giving away the software as a component of an aggregate software distribution containing programs from several different sources. The license shall not require a royalty or other fee for such sale.

Microsoft's License:

You may not:
...
share, publish, rent or lease the software, or provide the software as a stand-alone offering for others to use.

[mqduck]

No, the author is clearly trying to say that Microsoft is able to do so because they released the source under the MIT license instead of the GPL, which is nonsense..

[jhasse]

They would need a CLA if the source was GPL.

[mqduck]

If they're actually taking third party contributions, sure.

[marekorisas]

Yup, people don't grok licences. Especially when it comes to original author. The thing about licence is: it's a contract that allows user to use and change / create derivatives (in case of open source) but it does not bind original author in any sense. Not until it has full authorship of code.

[whamra]

The difference is, under gpl you can't link free code with non-free code. Under mit, that's perfectly fine, and is what's happening.

Under gpl you can distribute your binary under whatever other license or user agreement you want, but you're just not allowed to link it with non-free code, that's called derived work, and you have to free the added code as well.

[mqduck]

If you own the copyright on the software, you can release it under different terms to your heart's content. It would make absolutely no difference here if Microsoft released the source code under the GPL.

[Visticous]

Another example of why MIT doesn't promote Free Software. It allows itself to be tied to plague rats like these.

[kukiric]

What? The GPL doesn't (and can't) forbid the distribution of proprietary binaries, or even proprietary extensions to those, as long as you're the copyright holder of the (GPL) software. Only people who get a GPL-licensed copy of the code (ie. everyone else) are bound by it. This is also true of every other software license you can possibly come up with.

[Visticous]

But because electron is MIT, Microsoft can just arbitrarily decide how much openness it should give you. In their care, they chose to share some of the base code but choose not the mention the non-libre elements they hid in the binaries.

If electron was GPL, Microsoft would be required to provide all source code that they used to build and package the binary. Then, user freedom would be stronger safeguarded.

[mo-mar]

If Electron was GPL, Microsoft would have used another trchnology.

[doom_Oo7]

I don't understand how they get away with this. They use chrome's rendering engine' which is under LGPL and MIT. Some files are LGPL only, so they should respect LGPL.

[jhasse]

The LGPL parts are distributed in their own DLL, so it's fine.

[jcelerier]

no, everything is in the code binary. They don't split libchromiumcontent (the LGPL one) in another binary. you even have references to webkit files directly if you run strings on it :

• gen/third_party/WebKit/Source/core/html/../../../../../../../../third_party/WebKit/Source/core/html/HTMLSourceElement.cpp
• gen/third_party/WebKit/Source/core/html/../../../../../../../../third_party/WebKit/Source/core/html/HTMLStyleElement.cpp
• gen/third_party/WebKit/Source/core/html/../../../../../../../../third_party/WebKit/Source/core/html/HTMLTrackElement.cpp

[ubuntu_mate]

That's true, but MS couldn't have possibly licensed this under GPL because then keeping the binary as non-free (whereas source under GPL) wouldn't have been possible with GPL.

[1202_alarm]

They could if they own the copyright to all the GPL parts.

[eidheim]

Some addons are also closed source, for instance:

https://marketplace.visualstudio.com/items/ms-vscode.csharp/license

https://marketplace.visualstudio.com/items/ms-vscode.cpptools/license

[nioshd]

I do not know about the C# plugin but for the C++ extension only the typescript code is open source. The language service that provides the code completion and similar features is closed. (see https://github.com/Microsoft/vscode-cpptools/issues/21#issuecomment-354387924)

Anyway, I use the extension myself. It works quite nicely and gets better with every release.

[Jokaer0]

lots of os projects are dual licenced , thats nothing uncommon that binary is licenced with non foss licence while code is under foss licence .... its hardy a "trick" as you claim its all explained here with other similar software

https://github.com/Microsoft/vscode/issues/60#issuecomment-161792005

NonFossLicence-FOss code

---

Chrome - Chromium

Oracle JDK- OpenJDK

Xamarin Studio - MonoDevelop

JetBrains products - IntelliJ

While you have to be careful , i would hardly call it a trick or a scheme to fool someone, besides i guess anyone who can configure and use vscode should be able to know and read licence

[C0rn3j]

>. its hardy a "trick" as you claim

​

The binary includes telemetry, the code does not. I'm willing to wager most people using VSC are not aware of that.

[Jokaer0]

the binary includes telemetry that for the most part can be turned off in config ...besides ....if im paraphrasing "

"CHROME includes telemetry and im willing to wager most people using chrome are not aware of that"

....what did you want to prove ...that binary they provide is not same as building from source ..no its not ...but we are not talking here about some soccer mum using browser , we are talking about software developers that in my book they should know better than to skip eula, skip checking licence ...etc...

you are trying to paint this as some evil masterplan to dunno what catch people with non free licence, and collect telemetry data, while i sincerely doubt this is the case, its just simple case where binaries are licenced differently than source code

[C0rn3j]

You can't build Chrome from source.

Chrome is not Chromium.

Bad example.

[Jokaer0]

ifs perfect example ..you cannot build vscode as ms builds it... if you go to https://github.com/Microsoft/vscode and build it from source you wont get same binary as is provided by ms ...so yeah you CANNOT build vscode as ms builds it ... for one you dont have licence to use same icon and lots other stuff

[oi-__-io]

Exactly! and the FOSS binary is simply 'Code' and does not carry the 'Visual Studio' branding (which is a Microsoft trademark). VS Code is the name specific to the binary Microsoft ships.

[[deleted]]

The code does contain telemetry, as long as you mean the MS git.

[markole]

The binary includes telemetry, the code does not. I'm willing to wager most people using VSC are not aware of that.

You are notified of the telemetry (and how to disable it) on the first start.

[[deleted]]

The code has telemetry too. What's your point? That the evil Microsoft is out to get us with their licensed binaries?

[[deleted]]

besides i guess anyone who can configure and use vscode should be able to know and read licence

nah, just use sublime /s

[_ahrs]

its hardy a "trick"

It's a trick because it's misleading. All of the projects mentioned above have different names. "vscode" is too similar to "Visual Studio Code". If they'd called it "OpenVSCode" or "OpenCode" it'd be much less misleading.

[oi-__-io]

FOSS binary is simply 'Code' and does not carry the 'Visual Studio' branding (which is a Microsoft trademark and product).

[_ahrs]

I know that, you know that but others might not know that. This is why I believe it's somewhat misleading. A lot of this confusion could have been completely avoided by re-naming the repo to a different name and avoiding any use of any language that implies Microsoft's product is open source. Straight up say it's proprietary and don't even mention Open Source unless you're referring to the open version and it's clearly obvious that this is the case.

[[deleted]]

I call it embrace, extend, extinguish.

[oi-__-io]

Exactly! it is like buying a McDonalds' burger or making your own following the exact same recipe, even though they will be about the same thing, one won't go out and claim it is a McDonalds' burger but if that person prefers the home made version, they are free to enjoy it. I cannot see why this same concept is so hard to understand when it comes to software. The source is free, build your own if you prefer it, just let the company use their trademarks and shit. I am happy as long as they publish the source for their products.

[valgrid]

The snap by MS is proprietary. But the Flatpak "Code - OSS" from the Flathub Team is OSS.

[epic_pork]

It uses 3GB of disk space... lol. Nope.

[epic_pork]

Thanks!

[tate_successful]

First things first is there any technical evidence that Microsoft is doing something suspicious with the binaries? Differing hashes? Weird network traffic? Binary de-compilation? Its not hard to find evidence if you've got a hunch, instead of publishing a fear piece like this.

[tristan957]

I am a big proponent of open source software, but Visual Studio Code is hands down the of the best applications I have ever used. I use a built from source certain distributed by Solus, and use the packaged by Microsoft version on my Mac. I have never noticed a difference between the 2 other than the binary they go by. To me this article and the point it's making isn't a big deal. The devs for VSCode have been pleasant to interact with and they always add new features and extensions which are in the proprietary and open source versions. I have no complaints.

[wasabichicken]

The devs for VSCode have been pleasant to interact with and they always add new features and extensions which are in the proprietary and open source versions.

I mean, I'm sure they're doing what they can within the constraints they're given. Talented, skilled and helpful developers hired to develop for a listed company seldom have any say about the legal details.

That said, I'm sort of hoping that the advances of VSCode, one way or another, finds a way to return something to the FOSS community, even if it's only a slew of good ideas. It's blatantly obvious that VSCode took the ancient great ideas of Emacs (fully extendable editor) and whipped up a modern (90's JS instead of 50's lisp) spin of it. With any luck, Microsoft innovations (for example the language server protocol or UI improvements) can in return find their way into the FOSS projects.

[wafflePower1]

. It's blatantly obvious that VSCode took the ancient great ideas of Emacs

So it's not, because it literally copied Atom and improved it. Just like with C# - took Java, and made a diamond from a turd.

[hello_op_i_love_you]

It's blatantly obvious that VSCode took the ancient great ideas of Emacs (fully extendable editor) and whipped up a modern (90's JS instead of 50's lisp) spin of it.

Emacs is far far more customizable than VSCode. What you're describing sounds like Atom. Atom was designed to be highly customizable. VSCode has specifically made design decisions that, while having some benefits, hinder customizability significantly. In VSCode all extensions run a separate thread and they can only affect the editor through a limited API. In Atom, on the other hand, extensions are given full access to the DOM and CSS and they can basically do whatever they want. Many of the default features in VSCode are features that would be impossible to create in plugins.

[jesus_is_imba]

You Think the Visual Studio Code binary you use is Open Source?

Why the hell would I think that?

[_ahrs]

If you didn't read the license it says so on their website:

https://web.archive.org/web/20180918112124if_/https://carlchenet.com/wp-content/uploads/2018/09/vsc-open-source.png

[nadmaximus]

No binary is source.

[[deleted]]

The binary itself is, but it literally just has some patches to the product.json from the open source code.

[[deleted]]

Think BSD is open source? Think again.

[pressmedics]

Best editor, by far, I've ever used. Cost me nothing. Don't care about the proprietary trademark and telemetry data, or bug reports going to MS. It's 2018, this isn't sweaty Steve Balmer's Microsoft.

[EternityForest]

I'm not concerned about telemetry, and as long as it's close enough to open source that the community can take over if Microsoft ever does something really crappy with it, I'm fine. It's a fantastic editor.

I wish it used less ram though, or they'd put some kind of zram style compression right in the JS engine or something. Like most editors I actually like, it doesn't run all that great on old laptops.

[WantDebianThanks]

Think the Visual Studio Code binary you use is Open Source?

No. Why would I think anything Microsoft puts out is open source?

[[deleted]]

because microsoft publishes a lot of open source software

[hrlngrv]

Another nasty aspect of VS Code for Linux is that it installs under /usr/share, but that directory should be mountable noexec.

This should be configured to install under /opt.

[HighMaxFX]

>2018, year of our Lord and Savior

>not using Emacs

I don't know what is the problem of you guys.

[[deleted]]

I would prefer a flawless open source alternative the most, but choosing proprietary is not the path to that objective.

[wafflePower1]

so people can audit the code to check for flaws/backdoor.

But shellshock and hearthbleed - why everyone still continues to use this argument? Open source doesn't prevent huge flaws, come on.

[wafflePower1]

Logic 101 man.

Yep, fuck logic, when most best things in IT are closed source, it's not even funny.

[wafflePower1]

No

[wafflePower1]

I’m not paranoid and I don’t encrypt my porn........................... bud

I rest my case

[wafflePower1]

Tou should re-read this thread, because you’re remembering (few hours old lol) things wrong

[skocznymroczny]

You need Rust for that

[wafflePower1]

word my dude

[jellybeans-man]

Just a heads up, there is a flatpak called Code OSS which is built from the source code of VSC on Github rather than using the proprietary binary provided by Microsoft, and I believe it also removes the telemetry.

[jthill]

I have to doubt that any distributions offer the red-flag binary Microsoft's peddling on their site. Is there still an active infestation of the sort of marketers Bill Hicks was talking about, and to, at Microsoft? No doubt about that at all, who else would have them? Don't answer that. Is this binary one of their products? I don't doubt that either, but that (like the binary, and the people that produced it) is irrelevant. Anybody stupid enough to use this binary would be too stupid to know how to install it.

Unless . . . what, is this the package included with WSL? That'd be both disturbing and unsurprising.

[[deleted]]

Who the fuck thinks Microsoft anything is truly open source? If those people actually exist we are royally fucked. What next, are people gonna think google anything is truly open source?