VSCode silently opts you in to data collection

[tapirl]

I disabled the telemetry feature before, but the latest vsc version reverts it to enabled automatically, holy creepy.

And the latest version introduces many other data collection ways. Search them in settings with the keyword "online", you will find them all. Don't know whether or not there are other hidden ways which are not shown in the setting page.

[auchenberg]

Hi It's Kenneth from VS Code.

We have looked into this, and haven't found an intentional change that should change your opt-out settings. This shouldn't happen.

We have two theories:

1) Your settings file was deleted, which means that you would have lost all of your settings, and not just the telemetry setting. This can happen if the AppData or ~/Library/Application Support was cleaned up.

2) One of your installed extensions updated the settings either accidentally or on purpose. This would require further debugging, and a list of your installed extensions.

To help debug this further, it would be great help if you could open an issue on Github, https://github.com/Microsoft/vscode/, with more details about your OS, VS Code version and installed extensions, so we can figure out what happened.

Thanks!

/k

[nathantotten]

I’d file a bug. This is almost certainly not intentional.

[tmkbry]

https://imgur.com/a/wii2zVT is what everybody gets when starting VSCode for the first time.

[cwyers]

Yes. The title is against site guidelines ("Otherwise please use the original title, unless it is misleading or linkbait; don't editorialize.") and it's incorrect; there's nothing silent about it.

[samuelg123]

I’d argue this isn’t enough. They should explicitly ask, especially when you’re using the application to handle sensitive material such as unreleased code.

[DannyBee]

Except even if that was enough, people upgrading were just auto-opted back in (AFAICT). It definitely happened to me!

[sam0x17]

This is why it is a great idea to use VSCodium. An open source fork of VSCode that removes telemetry and packages itself for all major operating systems.

https://github.com/VSCodium/vscodium

[smartbit]

After installing VSCodium, you must manually disable telemetry in your settings file to stop it from sending tracking data to Microsoft.

https://github.com/VSCodium/vscodium#getting-all-the-telemet...

[ukyrgf]

I am so tired of having to do this with every shiny new thing. I get on board, stop paying attention for a few months, and then have to hunt down the latest third-party abstraction to enable a common sense security/maintainability/accessibility mindset. God bless them for fixing the problem, but this is just exhausting.

[craftyguy]

You could also just use a competent editor that isn't made by a company who 'needs' to collect 'telemetry' from all their users. Playing a game of cat and mouse is not going to convince MS to stop being evil.

[theprotocol]

I had no idea this existed. Thanks!

[russdpale]

Holy moly true pro tip. Thanks good person!!!

[nathantotten]

I know a lot of people don’t like things like this, but also remember not all data collection is malicious. If you look at what they actually collect it’s not pulling a bunch of personal info. They collect usage, perf and errors. As a product manager (not for vsc or MS) I use this type of telemetry all the time to make priorization decisions. It’s a balance, but my hunch is the team at MS uses this info exclusively to make the product better.

Of course, you should always be able to disable this sort of collection.

[TheAceOfHearts]

No, you should ALWAYS explicitly ask for user consent. You should explain exactly what kind of data is being collected and how it's used and ask them if they are fine with that. Anything else is unethical.

I'll happily enable certain kinds of data collection when a tool is transparent and it makes its data collection opt-in.

[makecheck]

Internet access is still pretty variable throughout the world (or even within countries that can have good speeds, like the US). Anything randomly uploading megabytes is going to cost somebody an unreasonable amount of money so there should be consent.

[jjeaff]

I agree. Most telemetry gathering is not malicious. But I always disable it simply because I use a lot of software. Telemetry from all of it would just be a big outgoing stream of data all the time.

[krn]

How is VSCode different from Firefox? Both have telemetry enabled by default, and both allow to opt out of it[1].

[1] https://www.mozilla.org/en-US/privacy/firefox/

[WalterGR]

How is VSCode different from Firefox? Both have telemetry enabled by default

Yep. So does Google Chrome, Apple macOS, Apple iOS, Canonical Ubuntu, and an uncountable number of programs, apps, and websites.

But VSCode is a Microsoft product, so it gives us an opportunity to do some serious pearl clutching and collectively lose our shit.

[Laaas]

I don't see why Firefox is relevant? It's still a shame that they are both like that though.

[userbinator]

Unless it's otherwise known, I think it's safe to assume that every not-tiny application contains phone-home spyware these days. It's not long ago when that wasn't the case, and many users had application firewalls that would alert (and block by default) such attempts. I'd say Win10 was probably the "breaking point" for such behaviour being normalised.

I'm one of those (probably tiny minority) who inspect the binaries of closed-source applications before using them, and will reject those containing networking-related functionality if the application should have no reason to do so.

[craftyguy]

Emacs doesn't try to 'phone home' and it's the very definition of a 'not-tiny' app. Neither does (neo)vim.

[yjftsjthsd-h]

What kind of inspection do you do? I assume something more involved than strings(1)?

[theclaw]

Funny, I just caught Win10 sending info about me opening and closing services.msc, and sending my taskbar searches to office and onedrive. Couple of Windows Firewall rules stopped it.

You can see it all in Wireshark, there’s a ton of it.

[mygo]

why not use something like Little Snitch or even TripMode to add opt-in functionality for all apps trying to make network connections?

[brett40324]

When I first installed vscode, I assumed this was the case and yep, there it was buried in preferences. Disable all of it, including automatic updates. When you want to update, uninstall and install again fresh. Then disable again. Repeat.

[paglia_s]

Has everyone already forgotten about GDPR?

[ygra]

Is this personally identifiable information? If not, then the GDPR has nothing to do with it.

[kgwxd]

At least they changed the code names, it used to be "telemetry.optIn = true", showing how little they understand the term opt-in.

[type0]

Any reason why Microsofts own extensions are not able use the global settings disabling telemetry?

https://github.com/Microsoft/vscode-docs-authoring/blob/mast...

[nathantotten]

The package they are using “vscode-extension-telemetry” actually does use the global setting. https://github.com/Microsoft/vscode-extension-telemetry/blob... Third-party extensions can read that setting too so they can respect the global choice.

[CamperBob2]

Because then they don't get to hoover up as much of your data.

[xte]

I have Emacs, why bother with other limited editors? Emacs can do what they do + far, far more so...

[rubiquity]

When Microsoft bought GitHub I didn’t think about GitHub Enterprise revenue. I thought about all of the language package managers that use GitHub’s APIs for downloading repos.

[purplezooey]

... extensions may be collecting their own usage data and are not controlled by the telemetry.enableTelemetry...

wtf. So it's like whack-a-mole.

[algorithm_dk]

Nothing new here, VSCode had this for a long time. Also I don't find anything wrong with shipping software with data collection on by default.

[naikrovek]

If someone wants to try to explain to me why the collection of application telemetry is bad, that'd be great.

[alangibson]

It's not inherently bad. Collecting telemetry on an opt-out basis, as opposed to opt-in, is.

[frogperson]

Is there a plug-in that pops a big red warning when telemetry is turned on? That's woul be very useful.

[electic]

I guess this might be a precursor to the type of behavior we can expect to see with the GitHub acquisition.

Secondly, is there anyone out there that has a solid emacs step by step guide that might be able to replicate the functionality of vscode? I haven't had time to look at it but I think the time has come where I can't put it off any longer.

[anonlastname]

is this at all surprising given that we're talking about the company that made windows? did we forget that for a while it would silently put telemetry in your binaries?

[WalterGR]

it would silently put telemetry in your binaries?

What do you mean?