Raspberry Pi Users Mortified As Microsoft Repository That Phones Home Is Added To Pi OS
One of the software options for running a Raspberry Pi module is Raspberry Pi OS (formerly Raspbian), the officially supported Debian-based operating system put out by The Raspberry Pi Foundation. It has been around since 2015 without too much complaint. However, a recent update has some Raspberry Pi OS users up in arms over a key change involving Microsoft.
The latest update installs a Microsoft apt respository on all any machine running Raspberry Pi OS, and does it without any admin consent. As discovered by Reddit user fortysix_n_2, the official reason is an endorsement of Microsoft's integrated development environment (IDE), Visual Studio Code (VSCode), which is fine and dandy. However, it's claimed this even gets installed on headless devices that used a light image without a GUI. As a result, every time you do an "apt update" on your Pi device, the OS pings Microsoft.
"By having this repo, every time an install of Raspberry Pi OS is updated it will ping a Microsoft server. Microsoft will know you're using Raspberry Pi OS/likely Raspberry Pi owner and your IP address. Many people try to reduce footprint as much as possible, so these are three additional datapoints Microsoft can use to build a profile about you," fortysix_n_2 explains.
Part of the concern is that Microsoft can potentially identify people as Raspberry Pi OS users when they tap into certain services, like Bing or GitHub (owned by Microsoft), and then build a profile for targeted advertising with that information. Some people may find that off-putting, while others may not. That is not the only concern, though.
"Never in my 2 decades of using Debian and Ubuntu has either modified my sources.list without my consent. What the actual f**k? I could understand if they just added it to the default installation image, but they had to actually write a script to add this repo to existing installations. That is shady as f**k!," a user commented in the thread.
"This is also on my 3 lite installations. I'm mad about this, because I always check what new dependencies are installed. Followed back the log, and can't find anything about this. Even the way it's installed is shady. With a postinstall script, not the usual 'extract' method," another user wrote.
This can make it easier for people who use VSCode, as some have pointed out. But phoning home has a way of giving people the heebie-jeebies (rightfully so in many cases), especially when it feels like the functional was added on the sly.
