HN Explorer

10 comments

[ 4.4 ms ] story [ 27.2 ms ] thread
ggm
Any os doing cron based apt updates has been pinging people since... forever. Pkg update is no different. How do you know who hosts the mirror? Microsoft could have been getting this feed for a long time simply by backing one of the existing feed sources with a free mirror.

All that's changed is that they now get it for having invested in WSL and vscode, under their own name.

GekkePrutser
Running a free mirror would get them some of the hits, not all.
ggm
Sampling vs counting. But, I get your point.
morninglight
"... This means Microsoft has access to every updated Pi computer running Raspberry Pi OS with rights to install any package, run any program, or edit any file without prompting the user. A lesser issue that has bothered some users is that on every run of apt update, the Raspbery Pi will send a request to packages.microsoft.com and thereby reveals the IP address for potential use in tracking or marketing efforts. "

https://en.wikipedia.org/wiki/Raspberry_Pi_OS#Microsoft_Repo...

joombaga
I don't understand the claim in the first sentence, and I don't understand how the linked thread supports it.
wazzaps
Any APT repo can push any package, e.g. this repo can give you a backdoored bash package
j0057
Sometimes repositories have duplicated packages, I'd be surprised if packages in earlier named repos didn't have precedence over later named repos. Meaning Microsoft couldn't just replace bash.
ppf
And that's before you even get to Microsoft owning ThreadX, the RTOS that runs on the pi before the main OS, and continues to run after boot.