raspberrypi-sys-mods package installed vscode repo?

[GarrickAndersLyng]

I recently heard about issues with the sudo package, so I decided to login to my webserver (raspbian buster on rpi 3 Model B Rev 1.2) and run apt.
What I got was a bit more than just sudo, which was expected as it had been a few weeks since logging in.
When I confirmed the upgrade everything went as normal except I noted a line stating that the vscode repo had been added. Checking the sources files and running apt confirmed that a new repo had been added.

rpi.png (118.33 KiB) Viewed 8823 times

Looking around on google, these forums, and the source files on github yielded no real answers as to why this had happened. Now I may be freaking out over nothing, but I'm at my wits end on this one. Should I be concerned or is this expected and I just didn't look closely enough?

[fruitoftheloom]

I recently heard about issues with the sudo package, so I decided to login to my webserver (raspbian buster on rpi 3 Model B Rev 1.2) and run apt.
What I got was a bit more than just sudo, which was expected as it had been a few weeks since logging in.
When I confirmed the upgrade everything went as normal except I noted a line stating that the vscode repo had been added. Checking the sources files and running apt confirmed that a new repo had been added.

rpi.png

Looking around on google, these forums, and the source files on github yielded no real answers as to why this had happened. Now I may be freaking out over nothing, but I'm at my wits end on this one. Should I be concerned or is this expected and I just didn't look closely enough?

viewtopic.php?f=63&t=301068

[DougieLawson]

Looking around on google, these forums, and the source files on github yielded no real answers as to why this had happened. Now I may be freaking out over nothing, but I'm at my wits end on this one. Should I be concerned or is this expected and I just didn't look closely enough?

You are freaking out over nothing. Microsoft VS Code is a recommended way to program your RPi Pico.
The repos have been added, nothing has been installed from those repos.

Also Microsoft seem to have a company wide direction towards supporting Linux systems in a sane, sensible and non-evil way. That's something we should praise them for. The bash shell extension for Windows 10 is an incredibly useful tool. Powershell is an open source replacement for the cmd line and arcane bat files.

[rpdom]

I'm not sure I agree with this.

Repos should not be added to a system without permissions from the owner/administrator.

There may be legal issues with this.

[B.Goode]

Repos should not be added to a system without permissions from the owner/administrator.

If you execute a command via sudo aren't you - the owner/administrator - granting that command permission to do whatever it chooses?

[DougieLawson]

I'm not sure I agree with this.

Repos should not be added to a system without permissions from the owner/administrator.

I agree with you.

But Raspberry Pi OS is the primary development system for the Raspberry Pi Pico and the RPF/RPTL have made an executive decision to include the VS Code stuff. That's the right way when you're telling folks to install it in the MagPi magazine and Hackspace magazine.

You can either go for easy or you can loose customers or induce bad feelings and hatred in your new customers (like other big software companies have achieved over the years).

The change is benign. If you don't like it remove the /etc/apt/sources.list.d/ files that have been added and run sudo apt update.

[jamesh]

I'm not sure I agree with this.

Repos should not be added to a system without permissions from the owner/administrator.

There may be legal issues with this.

I doubt there are any legal issues here. For example, where do you draw the line on stuff changed during an install or upgrade. Config files get changed all the time, and this is really just a config file. Do you say "No changes to configs at all" which basically makes updates not work? Nothing get installed from the repo so there no functional change.

[rpdom]

I'm not sure I agree with this.

Repos should not be added to a system without permissions from the owner/administrator.

There may be legal issues with this.

I doubt there are any legal issues here. For example, where do you draw the line on stuff changed during an install or upgrade. Config files get changed all the time, and this is really just a config file. Do you say "No changes to configs at all" which basically makes updates not work? Nothing get installed from the repo so there no functional change.

Changing a configuration file for software from a repo that has already been installed an accepted is one thing.

Adding a repo from a totally different source is entirely different.

Aside from the fact that third party could potentially issue a modified version of some software I have installed which would then get installed with apt upgrade, I think most IT professionals would balk at the idea of someone adding a repo like this without any warning.

I will be deleting these repo files if they appear on my machines and blocking them.

I may take other action.

[mrme01]

I'm not happy with this change either. This should not be a repo that's automatically added to any and all Raspbian installs out there.

I've sent a tweet about it, exclaiming the absurdity of such a thing.

[scruss]

I'm not so bothered about the adding of a repo: it doesn't do anything unless you install the unhelpfully-named code package.

What is more of an issue for me is that Visual Studio Code "phones home", sharing system metrics with Microsoft, unless you manually tell it not to. This is how you do that:

Disable telemetry reporting
From File > Preferences > Settings (macOS: Code > Preferences > Settings), search for telemetry, and uncheck the Telemetry: Enable Telemetry setting. This will silence all telemetry events from VS Code going forward. Telemetry information may have been collected and sent up until the point when you disable the setting.

[mijutu]

How about splitting the raspberrypi-sys-mods package into two packages: headless and desktop.

One package would contain hardware specific configuration changes that are needed or useful in most raspberry pi setups. The other would contain changes that are recommended or suggested for interactive desktop use, such as this repo addition.

[B.Goode]

How about splitting the raspberrypi-sys-mods package into two packages: headless and desktop.

One package would contain hardware specific configuration changes that are needed or useful in most raspberry pi setups. The other would contain changes that are recommended or suggested for interactive desktop use, such as this repo addition.

Makes no sense to me.


All my RPi systems are 'headless' - have no directly connected keyboard or display.

All my RPi systems are from time to time accessed either via the 'Raspberry Pi Desktop', or run individual 'gui' editors, IDEs, or other gui applications.


'Headless' is not synonymous with 'No Graphics.'

[GarrickAndersLyng]

Thank you everyone, for your input! I really appreciate your help!

[bensimmo]

I like it, it makes life easy for me.
Many other things have changed on my system without it explicitly asking each time, files and programs added and taken away to.

However,...
Can you not make it ask when it gets to that point? I've seen it pop up a few times for config changes in the past, you accept, default, keep old or merge changes.
(much to the annoyance of a long update session and you see it sat at that point.)

[gsh]

We've been in touch with Microsoft who have agreed we should point at their repo (rather than telling people to download VSCode from their website)

So there's nothing wrong here, as other's say, it's just the repo, you don't have to install anything from it and we won't have a dependency on anything from Microsoft in the Debian / Raspbian or Raspberry Pi repositories

Gordon

[InsulationTape]

Even the world's biggest advertising company gets this right, and provide instructions to modify the apt sources. Google Earth needs a repository adding.

I have had to edit 3 Pis, and of course any time in the future I update or try a new image I will have to hope to remember to clean out the corporate malware.

One of the many reasons I left proprietary platforms was because of the constant barrage of new avenues vendors try and force their way into your system.

MS may have offered to make it easy for users, but you have made it even easier for MS to have a go at locking more users in, and all the other awful habits proprietary vendors have.

Debian available on Pis yet?

[gsh]

As we noted previously, adding a repo to your distribution does not download anything to it. It is just a reference to a repo.

So you don't need to remove it.

[thradtke]

MS may have offered to make it easy for users, but you have made it even easier for MS to have a go at locking more users in, and all the other awful habits proprietary vendors have.

Wasn't there the same argument with the inclusion of Wolfram?

I personally love to see support from the industry, and in education, it is healthy to not isolate students from the real world but preparing them for it.

[mrme01]

As we noted previously, adding a repo to your distribution does not download anything to it. It is just a reference to a repo.

So you don't need to remove it.

So my Pi doesn't ping a MS server every time I run apt update with this repo enabled?

Why scan a repo for updates when I don't have any software on that repo installed?

[bensimmo]

As we noted previously, adding a repo to your distribution does not download anything to it. It is just a reference to a repo.

So you don't need to remove it.

So my Pi doesn't ping a MS server every time I run apt update with this repo enabled?

Why scan a repo for updates when I don't have any software on that repo installed?

That's fine, it's easier for you to remove it than beginners add it.

Edit.
Although, this needs the desktop?
So add the repository when VSCode (open source / freeware) is selected in the Recommended Software.?
Everyone's happy.

Lite doesn't and shouldn't need it
Desktop adds it when it is installed and used.
Full fat has it there and already installed
?

[bensimmo]

Even the world's biggest advertising company gets this right, and provide instructions to modify the apt sources. Google Earth needs a repository adding.
...
One of the many reasons I left proprietary platforms was because of the constant barrage of new avenues vendors try and force their way into your system.

... the other awful habits proprietary vendors have.

But then it isn't being bundled as a tool for use with a RaspberryPi device.

You do realise RaspberryPi are proprietary vendors?

[bls]

Lite doesn't and shouldn't need it

Not sure what your point is, but this got added on all My headless Pis running Lite.

For me, this is NOT a big deal. I simply commented out the line in vscode.list and moved on. Life is way too short to get worked up about something like this.

[bensimmo]

Lite doesn't and shouldn't need it

Not sure what your point is, but this got added on all My headless Pis running Lite.

For me, this is NOT a big deal. I simply commented out the line in vscode.list and moved on. Life is way too short to get worked up about something like this.

It is not a big deal to me either, it prefer it added.

But other don't.
I was giving a solution, Lite has no desktop, therefore no need to be released with it added.
But read it in context with the rest of the text. It is the three scenarios of the RPi OS Images.

[jamesh]

Lite doesn't and shouldn't need it

Not sure what your point is, but this got added on all My headless Pis running Lite.

For me, this is NOT a big deal. I simply commented out the line in vscode.list and moved on. Life is way too short to get worked up about something like this.

It is not a big deal to me either, it prefer it added.

But other don't.
I was giving a solution, Lite has no desktop, therefore no need to be released with it added.
But read it in context with the rest of the text. It is the three scenarios of the RPi OS Images.

Every difference between lite and full is something else that need to be specifically maintained. I guess it's simply easier to add it to all.

[bls]

I was giving a solution, Lite has no desktop, therefore no need to be released with it added.

While it's true that Lite has no desktop by default, many people install Lite and add their desired desktop packages (display manager, session manager, window manager, etc).

I do that, but have it disabled by default on most, but not all, of my systems. No software should assume that Lite doesn't have a desktop because it started out being installed as Lite.