6 ms·
This feels like a huge overreaction. "(...) every time an install of Raspberry Pi OS is updated it will ping a Microsoft server. Microsoft will know you're usi
by pedroaraujo 6y ago
This feels like a huge overreaction.
"(...) every time an install of Raspberry Pi OS is updated it will ping a Microsoft server. Microsoft will know you're using Raspberry Pi OS/likely Raspberry Pi owner and your IP address."
How is this is an issue? It doesn't require any login and this is exactly what happens with every APT mirror.
I imagine that Raspberry Pi OS is an distro meant for people who simply want things to work out of the box, I can see why the Raspberry foundation would want to add repos for easy installation of the VSCode.
If you want tight control of what happens in your system, you are free to install any other distro you want.
- someperson 6y agoIt's not just educational desktop environments: this issue affects Raspberry Pi OS Lite which is the primary operating system for Raspberry Pi's used in embedded and IoT applications. Some of which have automatic updates (called "unattended upgrades" in Debian parlance).
- pedroaraujo 6y agoBut this doesn't grant remote access to your system, and it's not like Microsoft will start shipping replacements of core packages over this repo.
- SecurityLagoon 6y agoTechnically it does grant another avenue of supply chain attack... but if Microsoft run mirrors are being compromised then we probably have much bigger issues than some raspberry pis.
- moistbar 6y agoConsidering the damage that can be done by botnets like Mirai, Raspberry Pis might be exactly what we should be worrting about.
- severino 6y ago> How is this is an issue? It doesn't require any login and this is exactly what happens with every APT mirror. Yes, but it's you who usually manage those mirrors, not some guy deciding which mirrors your apt must query now and pushing it in a regular update without notice. I don't care if it's Microsoft or some obscure Chinese repo, but I think nobody should mess with your mirrors list or trust their keys in this way.
- derision 6y agoIf you don't want "some guy" deciding which APT mirrors you use, then don't use "some guy's" linux distribution
- severino 6y agoNo, it doesn't work like that. You pay for something and you complain. Even if you don't. And if the guy doesn't like criticism, he can quit at any time.
- politelemon 6y ago> Yes, but it's you who usually manage those mirrors, That's not true for most people.