Hacker News Reader

Comment by ghuntley | Hacker News Reader

Hey folks, Geoff here from Gitpod. Very pleased to see there continues to be strong interest in open (and FOSS) software development tooling. VSCodium uses the OpenVSX registry (which Gitpod folks created) because the VS Market place is proprietary and can only be connected to from official Visual Studio branded products.

If you can't find an extension when using VSCodium then please send a pull-request to this repository https://github.com/open-vsx/publish-extensions with the identifier and that will help grow the ecosystem of open tooling.

ICMYI - We blogged more about this over at:

- https://www.gitpod.io/blog/cloud-ide-history

- https://www.gitpod.io/blog/openvscode-server-launch

- https://www.gitpod.io/blog/open-vsx

If you got any questions lemme know. <3

View on HN

Is there a way to tie VSCode extensions to their VSCodium counterparts? I installed codium and started manually installing plugins, but realized that authors, etc don't match up. For example, the Rails plugin in official VSCode shows "周鹏" as the author and 245K downloads, but in codium it's "bung87" with only 3.9K downloads.

I'm just thinking about supply chain attacks. I don't personally review all extension code on the VSCode side, but there's a certain amount of (false) comfort when over 200K folks have downloaded a particular extension.

Hi there, Filip from Gitpod here.

The discrepancies you mentioned come down to the extension Marketplace used - in VS Code, it is the Microsoft VS Code Marketplace, but in VS Codium it is by default https://open-vsx.org/ (basically a FOSS alternative to the Microsoft one).

The names don’t match up, because on Microsoft’s Marketplace the author handle (display name) is used, but Open VSX returns the username as the author name. The username of the author 周鹏 is bung87 on both the Microsoft Marketplace and OpenVSX. I think this is a good thing to reconsider though and thanks a lot for sharing!

> with only 3.9K downloads The difference in the download numbers is as simple as the Microsoft Marketplace having their own install counter; Open VSX has less users and therefore less downloads for the extension. It is true that Open VSX’s approach can be potentially dangerous, since an extension A on the VS Code Marketplace does not have to be the same extension A , it is built on the belief that people will be taking only their namespaces. The verification check mark can help on Open VSX extension pages with this, but it is not available on the VS Code side (yet anyway :)). The Rails extension you mentioned has the checkmark, so it means that it is published by someone who is a part of the project. You can take a look at how it looks like on the extension page: https://open-vsx.org/extension/bung87/rails.

Open VSX (and perhaps VS Code Marketplace) might consider adding support for identity verification through Keyoxide[0]. This would allow interested parties to easily determine whether the user bung87 on Open VSX and the user bung87 on VS Code Marketplace are really the same person and not just someone claiming the same username. There is already support for linking Keyoxide to one's GitHub account and even Hacker News, among other service providers.

[0] https://docs.keyoxide.org/advanced/for-service-providers/

Haven't heard of keyoxide before but it looks neat! Reminds me of keybase but decentralized and more focused!

Main Keyoxide dev here. That's an interesting suggestion, could be very useful! I don't have much experience with Open VSX or VS Code Marketplace. Do they have APIs for accounts?

I'm not affiliated with either, but from looking at some of the extension pages on Open VSX it appears they use GitHub accounts exclusively for publishers—so that part is already handled by the existing GitHub/Keyoxide integration. For VS Code Marketplace, the publisher pages do include a description section which could be used for the identity proof but there doesn't seem to be a (documented) REST API.

Hi there, I took a look at your site home page and docs, and still can't figure out what it is, or why someone would want to use it. Do you have a link to a 10,000 foot overview / simple use-case explanation, for a short-bus person such as myself?

Good overview is here: https://docs.keyoxide.org/getting-started/what-is-keyoxide/

From that page:

"Keyoxide allows you to prove "ownership" of accounts on websites, domain names, IM, etc., regardless of your username.

That last part is important: you could, for example, be 'alice' on Lobste.rs, but '@alice24' on Twitter. And if your website is 'thatcoder.tld', how are people supposed to know that all that online property is yours?

Of course, one could opt for full anonymity! In which case, keep these properties as separated as possible.

But if you'd like these properties to be linked and, by doing so, establish an online identity, you'll need a clever solution.

Enter Keyoxide.

When you visit someone's Keyoxide profile and see a green tick next to an account on some website, it was proven beyond doubt that the same person who set up this profile also holds that account."

Thank you. That's easy enough to understand, even for me ;-) The only piece that might use a bit more illumination, is what kind of people are likely to use Keyoxide to check on your proof of ownership once you've set it up, and why they would do so.

Thanks for the response!

"The names don’t match up, because on Microsoft’s Marketplace the author handle (display name) is used, but Open VSX returns the username as the author name."

I know it's insignificant, but that seems like a relatively easy and (marginally?) useful thing to change ;)

It also speaks to a fundamentally broken development process. This sort of thing shouldn't make it through wireframe review because it breaks the core tenet of building a competitor: not fucking with your users' expectations. Something as minor as changing what user handle is displayed was probably hand waved away, if it was even considered, yet here in this thread we have a demonstrable case of a user losing trust and confidence in the project simply as a result of this decision. If you want to convince people to use your software instead of what they're already using, you have to be as close to seamless as possible in all areas that aren't a benefit. In a case like this, the transition from the proprietary marketplace to the FOSS marketplace should be entirely seamless, and every UX change (even if it's an objective improvement, which this is clearly not) from what MS is currently doing represents lost users; the value comes from ethics, not software, so don't fix what isn't broken.

This isn't a huge issue, but it's one of the larger issues why FOSS alternatives are not often as well received as their proprietary counterparts (see: unix). Consumers/users should be the first/only consideration when designing user-facing software, but it's a rare sight to see in FOSS. I wish more FOSS developers cared about the software instead of the code, because the difference manifests in decisions like this.

> Something as minor as changing what user handle is displayed was probably hand waved away, if it was even considered, yet here in this thread we have a demonstrable case of a user losing trust and confidence in the project simply as a result of this decision.

If displaying the same "author" data resulted in users assuming that a given username on the Open VSX site should be trusted just because it happened to match a username on the VS Code Marketplace, it's probably a good thing that Open VSX displays the name differently. These are two different sites, and two different accounts; trust in one should not imply trust in the other. It would be even better if Open VSX could somehow ensure that the displayed author names never match the corresponding projects on VS Code Marketplace, for example by integrating a domain name or other globally-unique component into the author field.

But what good is verifying an uploaders display name, if anyone can set a display name to any value?

Hmmmm. What about swapping `display_name` + `account_is_verified` for `display_name` + `display_name_is_verified` or alternatively `display_name` / `verified_display_name`? The idea being to tie the verification mark to the display name, not just the account.

Such a scheme could then enforce policy in the verification process that imposes restrictions on what the display name would be allowed to be.

> I'm just thinking about supply chain attacks

You should still do that when getting software from the Microsoft stores. Microsoft is not all-seeing.

I had this exact same problem when making the switch from VS Code to VSCodium this past week. It would be nice if the same extensions matched.

Last time I looked the whole dev over SSH was not supported by VSCodium.

Is that going to change in the near future?

That's a proprietary Microsoft one. Same with LiveShare. Probably a few more.

C++ support, too. Thankfully there's a decent alternative in clangd (which is also available in many other editors).

LiveShare has a good open source replacement: CodeTogether.

Interesting to see which pieces of functionality they consider to be part of their moat vs commoditizing them

I installed it via homebrew on an M1 and got “VSCodium” can’t be opened because Apple cannot check it for malicious software. From what I can tell from https://github.com/VSCodium/vscodium/issues/228 I have to self sign. This seems like a security hole to me.

You should be able to override that warning in system settings. They make it inconvenient on purpose, and it's per-app, but you only have to do it once per app

The first time you launch vscodium, don't do so via "Open" or double-click; instead, right-click and choose open. This will give you the option to bypass macOS's GateKeeper just once, after which you can launch the app normally.

You use macOS, which deliberately tries to kill off apps that do not come through the app store (i.e. apps that Apple doesn't get a cut off of)

What is the obstacle to connecting codium to the VS Marketplace? Technical or legal?

For sure legal. Technically, it's extremely simple to change the Marketplace in VS Codium, but it is against the ToS of Microsoft's Marketplace to change it to theirs (see https://github.com/microsoft/vscode/issues/31168#issuecommen... for more details). As the linked comment also states, this is a big part of the reason why Open VSX was created and is widely used by VS Code forks.

Why would this be an issue? The code itself can't agree to the ToS, so only people using it could possibly do so, and depending on how the connection is set up, they might be able to skip agreeing to the ToS since that's just a client-side construction in MS VS (I hope).

So then the user can make the change, and then it's the user's ToS violation.

If the publisher makes this change in public then it's their ToS violation with receipts. I don't think you're really arguing that the VSCodium folks should make this change in violation of the ToS, sign it, and package it up...

They have built this whole alternative ecosystem so they can be in compliance.

does this allow only open source extensions, or proprietary ones as well? If it's the latter, is there a way to filter for only foss extensions? I don't use vscode/vscodium mostly because I didn't want to get suckered into having an open source trojan horse bring a bunch of proprietary crap into my system

There are many extensions that break in VSCodium because they expect the "code" binary. Where can I report that?

Hi, Filip from Gitpod here!

It is a bit puzzling to me that this would be an issue, since extensions generally do not call any VS Code binaries, they should ideally access everything through the VS Code Extension API (https://code.visualstudio.com/api) and never call any VS Code-related binaries, since VS Code can run on a portable mode as well. If issues like this arise, it is most likely a fault of the extension itself, so reporting should be done on a repository or an issue tracker of that extension. I have never seen an extension call the `code` binary, so I would guess it could realistically only be helpful for some kind of a workaround for an API limitation.

If you have any of these extensions that break on VS Codium, could you please share them with me? I would love to dig for more and help towards fixing said extensions there.

Is vscodium usable for .NET development and debugging?

The C# extension from the open-vsx repository is from Samsung. I've never used it but it looks like it uses omnisharp just like the MS version. I would say yes, it is usable.

Yes, through the Samsung debugger. See https://isdotnetopen.com for more information about remaining problems in the .net ecosystem. dotnet claims to be open but it really isn’t yet unfortunately…

Which other debugger could one use with VS code that is not from Microsoft?

Reply on news.ycombinator.com