VSCodium – Open-source binaries of VSCode (vscodium.com)

Article summary

VSCodium is a community-driven, freely-licensed binary distribution of Microsoft's editor VS Code, built from the open-source MIT-licensed source code. The project exists to provide a version of VS Code without Microsoft's telemetry and customizations. VSCodium can be installed using various package managers, including Brew, Windows Package Manager, and Snap. The project uses GitHub Actions to build and upload the binaries.

Main themes

• VSCodium and VS Code
• Open-source software
• Security and trust
• Supply chain attacks
• Software development and distribution
• Big companies vs smaller projects

What commenters say

• Some users are concerned about the security of VSCodium due to its smaller team and potential vulnerability to supply chain attacks.
• The use of GitHub Actions to build and upload binaries raises concerns about the lack of hash and signing verification.
• The project's build process is seen as less trustworthy than that of big companies like Microsoft, which have more extensive security measures in place.
• Others argue that the risks associated with VSCodium are mitigated by the fact that it is built from open-source code and that the build process is transparent.
• The discussion highlights the trade-offs between security, convenience, and trust in software development and distribution.
• Some commenters suggest that trusting big companies is not a guarantee of security, citing examples of past vulnerabilities and breaches.
• The importance of verifying the build process and ensuring the integrity of the software is emphasized.
• The role of open-source software in maintaining security and trust is debated, with some arguing that it is not inherently more or less secure than proprietary software.