[HN Gopher] Performance and Telemetry Analysis of Trae IDE, Byte...
___________________________________________________________________
Performance and Telemetry Analysis of Trae IDE, ByteDance's VSCode
Fork
Hi HN, I was evaluating IDEs for a personal project and decided to
test Trae, ByteDance's fork of VSCode. I immediately noticed some
significant performance and privacy issues that I felt were worth
sharing. I've written up a full analysis with screenshots, network
logs, and data payloads in the linked post. Here are the key
findings: 1. Extreme Resource Consumption: Out of the box, Trae
used 6.3x more RAM (~5.7 GB) and spawned 3.7x more processes (33
total) than a standard VSCode setup with the same project open. The
team has since made improvements, but it's still significantly
heavier. 2. Telemetry Opt-Out Doesn't Work (It Makes It Worse): I
found Trae was constantly sending data to ByteDance servers
(byteoversea.com). I went into the settings and disabled all
telemetry. To my surprise, this didn't stop the traffic. In fact,
it increased the frequency of batch data collection. The telemetry
"off" switch appears to be purely cosmetic. 3. What's Being Sent:
Even with telemetry "disabled," Trae sends detailed payloads
including: Hardware specs (CPU, memory, etc.) Persistent user,
device, and machine IDs OS version, app language, user name
Granular usage data like time-on-ide, window focus state, and
active file types. 4. Community Censorship: When I tried to
discuss these findings on their official Discord, my posts were
deleted and my account was muted for 7 days. It seems words like
"track" trigger an automated gag rule, which prevents any real
discussion about privacy. I believe developers should be aware of
this behavior. The combination of resource drain, non-functional
privacy settings, and censorship of technical feedback is a major
red flag. The full, detailed analysis with all the evidence
(process lists, Fiddler captures, JSON payloads, and screenshots of
the Discord moderation) is available at the link. Happy to answer
any questions.
Author : segfault22
Score : 557 points
Date : 2025-07-27 17:57 UTC (5 hours ago)
(HTM) web link (github.com)
(TXT) w3m dump (github.com)
| segfault22 wrote:
| Hi HN, I was evaluating IDEs for a personal project and decided
| to test Trae, ByteDance's fork of VSCode. I immediately noticed
| some significant performance and privacy issues that I felt were
| worth sharing. I've written up a full analysis with screenshots,
| network logs, and data payloads in the linked post.
|
| Here are the key findings:
|
| 1. Extreme Resource Consumption: Out of the box, Trae used 6.3x
| more RAM (~5.7 GB) and spawned 3.7x more processes (33 total)
| than a standard VSCode setup with the same project open. The team
| has since made improvements, but it's still significantly
| heavier.
|
| 2. Telemetry Opt-Out Doesn't Work (It Makes It Worse): I found
| Trae was constantly sending data to ByteDance servers
| (byteoversea.com). I went into the settings and disabled all
| telemetry. To my surprise, this didn't stop the traffic. In fact,
| it increased the frequency of batch data collection. The
| telemetry "off" switch appears to be purely cosmetic.
|
| 3. What's Being Sent: Even with telemetry "disabled," Trae sends
| detailed payloads including: Hardware specs (CPU, memory, etc.)
| Persistent user, device, and machine IDs OS version, app
| language, user name Granular usage data like time-on-ide, window
| focus state, and active file types.
|
| 4. Community Censorship: When I tried to discuss these findings
| on their official Discord, my posts were deleted and my account
| was muted for 7 days. It seems words like "track" trigger an
| automated gag rule, which prevents any real discussion about
| privacy.
|
| I believe developers should be aware of this behavior. The
| combination of resource drain, non-functional privacy settings,
| and censorship of technical feedback is a major red flag. The
| full, detailed analysis with all the evidence (process lists,
| Fiddler captures, JSON payloads, and screenshots of the Discord
| moderation) is available at the link. Happy to answer any
| questions.
| HAL3000 wrote:
| Advice for the future: Next time, it's better to ask the LLM to
| check your writing for grammatical errors rather than to
| rewrite it for you. The bullet points added a lot of
| unnecessary bloat and came across as very "LLM-ish."
|
| Also, if you'd like to hide the fact that you're from Poland or
| speak Polish, you should be more careful about what's visible
| on your screenshots :)
| circuit10 wrote:
| Is it just me or does the formatting of this feel like ChatGPT
| (numbered lists, "Key Takeaways", and just the general phrasing
| of things)? It's not necessarily an issue if you checked over it
| properly but if you did use it then it might be good to mention
| that for transparency, because people can tell anyway and it
| might feel slightly otherwise
|
| (or maybe you just have a similar writing style)
| marksomnian wrote:
| > might be good to mention that for transparency, because
| people can tell anyway and it might feel slightly otherwise
|
| Devil's advocate: why does it matter (apart from "it feels
| wrong")? As long as the conclusions are sound, why is it
| relevant whether AI helped with the writing of the report?
| jdiff wrote:
| Because AI use is often a strong indicator of a lack of
| soundness. Especially if it's used to the point where its
| structural quirks (like a love for lists) shine through.
| chrisnight wrote:
| It is relevant because it wastes time and adds nothing of
| substance. An AI can only output as much information as was
| inputted into it. Using it to write a text then just makes it
| unnecessarily more verbose.
|
| The last few sections could have been cut entirely and
| nothing would have been lost.
|
| Edit: In the process of writing this comment, the author
| removed 2 sections (and added an LLM acknowledgement), of
| which I referred to in my previous statement. To the author,
| thank you for reducing the verbosity with that.
| IncreasePosts wrote:
| Because AI isn't so hot on the "I" yet, and if you ask it to
| generate this kind of document it might just make stuff up.
| And there is too much content on the internet to delve deep
| on whatever you come across to understand the soundness of
| it. Obviously you need to do it at some point with some
| things, but few people do it all the time with everything.
|
| Pretty much everyone has heuristics for content that feels
| like low quality garbage, and currently seeing the hallmarks
| of AI seems like a mostly reasonable one. Other heuristics
| are content filled with marketing speak, tons of typos,
| whatever.
| Alifatisk wrote:
| Because it helps me decide if I should skim through or
| actually read it
| KapKap66 wrote:
| I just wanna read stuff written by people and not bots
|
| simple as
| slacktivism123 wrote:
| > As long as the conclusions are sound, why is it relevant
| whether AI helped with the writing of the report?
|
| TL;DR: Because of the bullshit asymmetry principle. Maybe the
| conclusions below are sound, have a read and try to wade
| through ;-)
|
| Let us address the underlying assumptions and implications in
| the argument that the provenance of a report, specifically
| whether it was written with the assistance of AI, should not
| matter as long as the conclusions are sound.
|
| This position, while intuitively appealing in its focus on
| the end result, overlooks several important dimensions of
| communication, trust, and epistemic responsibility. The
| process by which information is generated is not merely a
| trivial detail, it is a critical component of how that
| information is evaluated, contextualized, and ultimately
| trusted by its audience. The notion that it feels wrong is
| not simply a matter of subjective discomfort, but often
| reflects deeper concerns about transparency, accountability,
| and the potential for subtle biases or errors introduced by
| automated systems.
|
| In academic, journalistic, and technical contexts, the
| methodology is often as important as the findings themselves.
| If a report is generated or heavily assisted by AI, it may
| inherit certain limitations, such as a lack of domain-
| specific nuance, the potential for hallucinated facts, or the
| unintentional propagation of biases present in the training
| data. Disclosing the use of AI is not about stigmatizing the
| tool, but about providing the audience with the necessary
| context to critically assess the reliability and limitations
| of the information presented. This is especially pertinent in
| environments where accuracy and trust are paramount, and
| where the audience may need to know whether to apply
| additional scrutiny or verification.
|
| Transparency about the use of AI is a matter of intellectual
| honesty and respect for the audience. When readers are aware
| of the tools and processes behind a piece of writing, they
| are better equipped to interpret its strengths and
| weaknesses. Concealing or omitting this information, even
| unintentionally, can erode trust if it is later discovered,
| leading to skepticism not just about the specific report, but
| about the integrity of the author or institution as a whole.
|
| This is not a hypothetical concern, there are numerous
| documented cases (eg in legal filings
| https://www.damiencharlotin.com/hallucinations/) where lack
| of disclosure about AI involvement has led to public backlash
| or diminished credibility. Thus, the call for transparency is
| not a pedantic demand, but a practical safeguard for
| maintaining trust in an era where the boundaries between
| human and machine-generated content are increasingly blurred.
| pessimizer wrote:
| > As long as the conclusions are sound
|
| I can't decide to read something because the conclusions are
| sound. I have to read the entire thing to find out if the
| conclusions are sound. What's more, if it's an LLM, it's
| going to try its gradient-following best to make unsound
| reasoning seem sound. I have to be an expert to tell that it
| is a moron.
|
| I can't put that kind of work into every piece of worthless
| slop on the internet. If an LLM says something interesting,
| I'm sure a human will tell me about it.
|
| The reason people are smelling LLMs everywhere is because
| LLMs are low-signal, high-effort. The disappointment one
| feels when a model starts going off the rails is conditioning
| people to detect and be repulsed by even the slightest whiff
| of a robotic word choice.
|
| edit: I feel like we discovered the direction in which AGI
| lies but we don't have the math to make it converge, so every
| AI we make goes completely insane after being asked three to
| five questions. So we've created architectures where models
| keep copious notes about what they're doing, and we carefully
| watch them to see if they've gone insane yet. When they
| inevitably do, we quickly kill them, create a new one from
| scratch, and feed it the notes the old one left. AI slop
| reads like a dozen cycles of that. A group effort, created by
| a series of new hires, silently killed after a single
| interaction with the work.
| unethical_ban wrote:
| Theory: Using AI and having an AI voice makes it less likely
| the conclusions are sound.
| lynndotpy wrote:
| AI-generated content is rarely published with the intention
| of being informative. * Something being apparently AI-
| generated is a strong heuristic that something isn't worth
| reading.
|
| We've been reading highly-informative articles with "bad
| English" for decades. It's okay and good to write in English
| without perfect mastery of the language. I'd rather read the
| source, rather than the output of a txt2txt model.
|
| * edit -- I want to clarify, I don't mean to imply that the
| author has ill will or intent to misinform. Rather, I intend
| to describe the pitfalls of using an LLM to adapt ones text,
| inadvertently adding a very strong flavor of spam to
| something that is not spam.
| davrosthedalek wrote:
| True, but there are many more people that speak no English,
| or so badly that an article would be hard to understand. I
| face this problem now with the classes I teach. It's an
| electronics lab for physics majors. They have to write
| reports about the experiments they are doing. For a large
| fraction, this task is extraordinary hard not because of
| the physics, but because of writing in English. So for
| those, LLMs can be a gift from heaven. On the other hand,
| how do I make sure that the text is not fully LLM
| generated? If anyone has ideas, I'm all ears.
| lynndotpy wrote:
| I don't have any ideas to help you there. I was a TA in a
| university, but that was before ChatGPT, and it was an
| expectation to provide answers in English. For non-native
| English speakers, one of the big reasons to attend an
| English-speaking university was to get the experience in
| speaking and reading English.
|
| But I also think it's a different thing entirely. It's
| different being the sole reader of text produced by your
| students (with responsibility to read the text) compared
| to being someone using the internet choosing what to
| read.
| circuit10 wrote:
| Looks like I missed a word here (probably "disingenuous")
| segfault22 wrote:
| Yea, the core was written by me, i just used llm to fix my
| broken english.
| benreesman wrote:
| Don't pay any attention to people giving you shit for using
| translation software. A lot of us sometimes forget that the
| whole world knows a little English and most of us native
| speakers have a ridiculous luxury in getting away with being
| two lazy to learn a few other languages.
| Fade_Dance wrote:
| I think it's good form to mention it as a little
| disclaimer, just so people don't take it the wrong day.
| Just write (this post was originally written by me but
| formatted and corrected with LLM since English is not my
| primary language).
|
| From what I've seen, people generally do not like reading a
| generated content, but every time I've seen the author come
| back and say "I used it because it isn't my main language"
| the community always takes back the criticism. So I'd just
| be upfront about it and get ahead of it.
| drewbitt wrote:
| That was already added before this reply.
| Latty wrote:
| Part of the problems with using LLMs for translation is
| precisely that they alter the tone and structure of what
| you give it, writing using the LLM cliches and style, and
| it's unsurprising people see that and just assume
| completely generated slop. It's unfortunate, and I would
| probably try and use LLMs if English wasn't my first
| language, but I don't think it's as simple as "using
| translation software", I've not seen people called out in
| that way for dodgy Google Translate translations, for
| example, it's a problem specific to LLMs and the output
| they make having fundamental issues.
| goopypoop wrote:
| my nipples explode with delight!
| bogwog wrote:
| LLM writing style does to the brain what Microsoft Sam
| does to the ears.
| circuit10 wrote:
| I wasn't annoyed about it, I just said it might be good to
| mention because people will notice anyway, and at this
| point there's enough AI slop around that it can make people
| automatically ignore it so it would be good to explain
| that. I'm surprised I got downvotes and pushback for this,
| I thought it was a common view that it's good to disclose
| this kind of thing and I thought I was polite about it
| circuit10 wrote:
| To be clear I think this has good information and I
| upvoted it, it's just that as someone else said it's good
| to get ahead of anyone who won't like it by explaining
| why and also it can feel a little disingenuous otherwise
| (I don't like getting other people to phrase things for
| me either for this reason but maybe that's just me)
| lynndotpy wrote:
| It's disingenuous to call LLMs "translation software", and
| it's bad advice to say "don't pay attention those people".
|
| Even if you don't agree with it, publishing AI generated
| content will exclude from ones audience the people who
| won't read AI generated content. It is a tradeoff one has
| to decide whether or not to make.
|
| I'm sympathetic to someone who has to decide whether to
| publish in 'broken english' or to run it through the latest
| in grammar software. For my time, I far prefer the former
| (and have been consuming "broken english" for a long while,
| it's one of the beautiful things about the internet!)
| benatkin wrote:
| > using translation software
|
| It's clear that this isn't what OP was doing. The LLM was
| _writing_ , not merely _translating_. dang put it well:
|
| > we want people to speak in their own voice
|
| https://news.ycombinator.com/item?id=44704054
| atdt wrote:
| Your content is great, and the participation of non-native
| English speakers in this community makes it better and
| richer.
| userbinator wrote:
| I'd rather you write in broken English than filter it through
| an LLM. At least that way I know I'm reading the thoughts of
| a real human rather than something that may have its meaning
| slightly perturbed.
| MangoCoffee wrote:
| who care? its like using a spell checker. why does it matter?
| spyridonas wrote:
| Great analysis, well done ! Since you've already done VSCode,
| Trae, Cursor, can you analyse Kiro (AWS fork). I'm curious about
| their data collection practices.
| cuuupid wrote:
| Anecdata but Kiro is much, much, much, much easier to put
| through corporate procurement compared to its peers. I'm
| talking days vs months.
|
| This is not because it is better and I've seen no inclination
| that it would somehow be more private or secure, but most
| enterprises already share their proprietary data with AWS and
| have an agreement with AWS that their TAMs will gladly usher
| Kiro usage under.
|
| Interesting to distinguish that privacy/security as it relates
| to individuals is taken at face value, while when it relates to
| corporations it is taken at disclosure value.
| drewbitt wrote:
| They don't want telemetry ever disabled, even for a minority of
| people who do toggle it off. Why?
| msgodel wrote:
| Telemetry toggles add noise to the data at the very least. IMO
| it's part of the reason you're actually better off with no
| client-side telemetry at all. Obviously they see it the
| opposite way.
| imglorp wrote:
| Disabling telemetry might be interpreted as a self-indicated
| signal of "I have something to hide", so they jack up the
| snooping.
| HPsquared wrote:
| I suspect many (or all) VPNs probably do secret logging.
| People will do their most interesting secret activities on
| those.
| rvnx wrote:
| Like Signal users. The only thing it signals is that the
| user is interesting. There is also a reason why it is not
| allowed for classified use.
| const_cast wrote:
| This isn't true, this is the sort of toxic "if I have
| nothing to hide then why value privacy" ideology that got
| us into this privacy nightmare.
|
| Every single person has "something to hide", and that's
| normal. It's normal to not want your messages snooped
| through. It doesn't mean you're a criminal, or even
| computer-saavy.
| rvnx wrote:
| Mhhh it is not really about "nothing to hide", it was
| more that if you use niche services targeted at privacy,
| it puts a big target on you.
|
| Like the Casio watches, travelling to Syria, using Tor,
| Protonmail, etc...
|
| When it is better in reality to have a regular watch, a
| Gmail with encrypted .zip files or whatever, etc.
|
| It does not mean you are a criminal if you have that
| Casio watch, but if you have this, plus encrypted emails,
| plus travel to some countries as a tourist, you are
| almost certain to put yourself in trouble for nothing,
| while you tried to protect yourself.
|
| And if you are a criminal, you will put yourself in
| trouble too, also for nothing, while you tried to protect
| yourself.
|
| This was the basis of Xkeyscore, and all of that to say
| that Signal is one very good signal that the person may
| be interesting.
| const_cast wrote:
| 1. I don't really think this is true generally.
|
| 2. Using a secure, but niche, service is still more
| secure than using a service with no privacy.
|
| Sure, you can argue using Signal puts a "target" on your
| back. But there's nothing to target, right? Because it's
| not being run by Google or Meta. What are they gonna
| take? There's no data to leak about you.
|
| If I were a criminal, which I'm not, I'd rather rob a
| bank with an actual gun than with a squirt gun. Even
| though having an actual gun puts a bigger target on your
| back. Because the actual gun works - the squirt gun is
| just kinda... useless.
| bigprof wrote:
| What flag does using a Casio watch raise? I have a G
| Shock that i love though i don't wear it as often
| nowadays.
| Mogzol wrote:
| The F-91W has long been associated with terrorism for
| it's use in improvised time-bombs: https://en.wikipedia.o
| rg/wiki/Casio_F-91W#Usage_in_terrorism
| spookie wrote:
| Oh so now we target people for buying inexpensive things?
| "Oh no! This guy doesn't have a $500 watch".
| sejje wrote:
| Or "I'm a power user" of sorts. Probably a very small
| minority of users fiddle that setting.
|
| Dang said a similarly small minority of users here do all the
| commenting.
| Etheryte wrote:
| This is true of practically every online community. The
| vast majority of the users are passive participants, a
| small fraction contribute, and a small subset of
| contributors generate most of the content. Reddit is a
| prime example of this, the numbers are incredibly lopsided
| there.
| qiine wrote:
| almost as if it was a trap... ;p
| viraptor wrote:
| That's assuming this is intended behaviour rather than just a
| bug that they don't care about fixing.
| yard2010 wrote:
| Occam's razor. Not Hanlon's.
| hollowonepl wrote:
| I so much like the fact that I've come back to TUI (helix editor)
| recently.
|
| I'm trying ZED too, which I believe as a commercial product comes
| with telemetry too.. but yeah, learning advanced rules of a
| personal firewall always helpful!
| xyzal wrote:
| Now imagine we trust this company with collecting psychological
| profiles of future western politicians ...
| reaperducer wrote:
| And future members of the military, the media, CEOs, etc...
| neuroelectron wrote:
| VSCode is extremely unsafe and you should only use it in a
| managed, corporate environment where breaches aren't your
| problem. This goes with any fork, as well.
| CaliforniaKarl wrote:
| If you signed a Nondisclosure agreement with your employer, and
| you use--without approval--a tool that sends telemetry, you may
| be liable for a breach of the NDA.
| shortrounddev2 wrote:
| Unsafe because of telemetry or unsafe because of the plugin
| ecosystem?
| dotancohen wrote:
| What should I be reading to know more about this? I am
| considering a move from Jetbrain's products to VS Code.
| cyberpunk wrote:
| I tried this move once and lasted three days.
|
| Opening IDEA after those three days was the same kind of
| feeling I imagine you'd get when you take off a too tight
| pair of shoes you've been trying to run a marathon in.
|
| ymmv, of course, but for $dayjob I can't even be arsed trying
| anything else at this point, it's so ingrained I doubt it'll
| be worth the effort switching.
| dmitrygr wrote:
| I remind you, again, that vi, gcc, as, ld, and make have no
| telemetry, launch few (if any) processes, do not need GB of RAM,
| and work well.
| dotancohen wrote:
| I am a die hard VIM user. VIM is a text editor, not an IDE. You
| can I many D tools into it's E, but it remains a text editor
| with disparate tools.
| 63stack wrote:
| What is there in an IDE today, that is missing from (n)vim?
| With the advent of DAP and LSP servers, I can't find anything
| that I would use a "proper" IDE for.
| viraptor wrote:
| - debuggers
|
| - popup context windows for docs (kind of there, but having
| to respect the default character grid makes them much less
| capable and usually they don't allow further interaction)
|
| - contextual buttons on a line of code (sure, custom
| commands exist, but they're not discoverable)
|
| - "minimap"
| godelski wrote:
| > debuggers
|
| Parent mentioned >> DAP
|
| Here's the docs[0] > popup context
| windows for docs
|
| These are called "balloon"s[1]. Plenty of people have
| setups for things like docs (press "K") or other things
| (By default "K" assumes a man page) >
| contextual buttons on a line of code
|
| I don't know what this means, can you explain?
| > minimap
|
| Do you mean something like this?[2] Personally, I use
| tagbar[3] as I like using ctags and being able to jump
| around in the project.
|
| The "minimap" is the only one here that isn't native. You
| can also have the file tree on the left if you want. Most
| people tend to use NerdTree[4], but like with a lot of
| plugins, there's builtins that are just as good. Here's
| the help page for netrw[5], vim's native File Explorer
|
| Btw, this all works in vim. No need for neovim for any of
| this stuff. Except for the debugger, this stuff has been
| here for quite some time. The debugger has been around as
| a plugin for awhile too. All this stuff has been here
| since I started using vim, which was over a decade ago
| (maybe balloons didn't have as good of an interface? Idk,
| it's been awhile)
|
| [0] https://vimdoc.sourceforge.net/htmldoc/debugger.html
|
| [1] https://vimdoc.sourceforge.net/htmldoc/options.html#'
| balloon...
|
| [2] https://github.com/wfxr/minimap.vim
|
| [3] https://github.com/preservim/tagbar
|
| [4] https://github.com/preservim/nerdtree
|
| [5] https://vimhelp.org/pi_netrw.txt.html#netrw
| viraptor wrote:
| > These are called "balloon"
|
| And are not interactive as far as I know. I've not seen a
| way to get a balloon on the type in another balloon and
| then go to the browser docs from a link in that.
|
| > Do you mean something like this?
|
| Yes, but that's still restricted to terminal characters
| (you could probably do something fancy with sixel, but
| still) - for larger files with big indents it's not
| useful anymore.
|
| > contextual buttons on a line of code
|
| For example options to refactor based on the current
| location. I could construct this manually from 3
| different pieces, but this exists in other IDEs already
| integrated and configured by default.
| 63stack wrote:
| Don't IDEs use DAP as well? That would mean neovim has
| 1:1 feature parity with IDEs when it comes to debugging.
| I understand the UI/UX might need some customization, but
| it's not like the defaults in whatever IDE fit everyone
| either.
|
| Popup context windows for docs are super good in neovim,
| I would make a bet that they are actually better than
| what you find in IDEs, because they can use treesitter
| for automatic syntax highlighting of example code. Not
| sure what you mean with further interaction.
|
| Contextual buttons are named code actions, and are
| available, and there are like 4 minimap plugins to choose
| from.
| nsm wrote:
| The "integrated" part. I've written some here
| https://news.ycombinator.com/item?id=42871586
| godelski wrote:
| > VIM is a text editor, not an IDE
|
| I'm with you, but I don't see the problem with their
| argument. They should have mentioned GDB, Valgrind, and maybe
| things like pdb and ruff, but I think their point was clear
| enough without it. Hell, in vim I use ruff for linting and
| you can jump into a debugger. When you have it configured
| that way people do refer to it as an IDE. It isn't
| _technically_ correct but it gets the point across to the
| people who wouldn 't know that
| rs186 wrote:
| I install vscode from scratch, install a few extensions I need,
| set 3 or 4 settings I use regularly, and bang in 5 minutes I
| have a customized, working environment catered for almost any
| language.
|
| vi? Good luck with that.
|
| And I say that as an experienced vim user who used to tinker a
| bit.
| godelski wrote:
| > I install vscode from scratch, install a few extensions I
| need, set 3 or 4 settings I use regularly, and bang in 5
| minutes I have a customized, working environment catered for
| almost any language.
|
| Weird, I'd say that's my experience with vim. I just carry
| around by dotfiles, which is not that extensive.
|
| Hell, I will even feel comfortable in a vi terminal, though
| that's extremely rare to actually find. Usually vi is just
| remapped to vim
|
| Edit:
|
| The git folder with * _all*_ my dotfiles (which includes all
| my notes) is just 3M, so I can take it anywhere. If I install
| all the plugins and if I install all the vim plugins I
| currently have (which some are old and I don 't use) the
| total is ~100M. So...
| max_ wrote:
| Why isn't there a decently done code editor with VSCode level
| features but none of the spyware garbage?
|
| Any recommendations?
|
| This seems like an easy win for a software project
| dmead wrote:
| Emacs still exists
| userbinator wrote:
| So does vi.
| JLO64 wrote:
| As does Neovim
| dotancohen wrote:
| Emacs is great, sure, but it lacks a decent text editor.
| serf wrote:
| proof of emacs excellence.
|
| what other software packages have 200 year old jokes about
| them?
| cozzyd wrote:
| Vi would, if the users could figure out how to quit out
| to save the jokes.
| reaperducer wrote:
| _Why isn 't there a decently done code editor with VSCode level
| features but none of the spyware garbage?_
|
| Isn't that what VS Codium is for?
| max_ wrote:
| VSCodium I think was abandoned. It was extremely buggy last
| time I used it.
|
| Either way it uses electron. Which I hate so much.
| reaperducer wrote:
| _VSCodium I think was abandoned._
|
| Sad to hear that. I really enjoyed VS Codium before I
| jumped full-time into Nova.
|
| (Unsolicited plug: If you're looking for a Mac-native IDE,
| and your needs aren't too out-of-the-ordinary, Nova is
| worth a try. If nothing else, it's almost as fast as a TUI,
| and the price is fair.)
| mibsl wrote:
| It seems actively maintained, latest build on Flathub is
| from 3 hours ago.
| viraptor wrote:
| It's not abandoned
| https://github.com/VSCodium/vscodium/commits/master/
| dijit wrote:
| Because _someone_ has to fund it?
|
| Microsoft is content with funding it, the price is your
| telemetry (for now).
|
| For high quality development tools I use true FOSS; or I pay
| for my tools to avoid not knowing where the value is being
| extracted.
| benbristow wrote:
| I thought with VS Code the price is that it entices you into
| using Azure, where the enterprise big bucks are made.
| not_a_bot_4sho wrote:
| > Microsoft is content with funding it, the price is your
| telemetry (for now).
|
| The price of VSCode is halo effect for Azure products
| bsder wrote:
| The price of VSCode is the lockin on the proprietary
| extensions.
|
| Specifically: the remote code extension, the C/C++
| extension and the Python extension.
| Sammi wrote:
| I'm eying Zed. Unfortunately I am dependent on a VS Code
| extension for a web framework I use. VS Code might have gotten
| to a critical level of network effect with their extensions,
| which might make it extremely sticky.
| cyberax wrote:
| > Why isn't there a decently done code editor with VSCode level
| features but none of the spyware garbage?
|
| JetBrains products. Can work fully offline and they don't send
| "telemetry" if you're a paying user:
| https://www.jetbrains.com/help/clion/settings-usage-statisti...
| charcircuit wrote:
| Because telemtry is how you effectively make a decently done
| editor. If you don't have telemtry you will be likely lower
| quality and will be copying from other editors who are able to
| effectively build what users want.
| ThinkBeat wrote:
| emacs.
| asciii wrote:
| Great write up OP!
|
| Your analysis is thorough, and I wonder if their reduction of
| processes from 33 to 20...(WOW) had anything to do with moving
| telemetry logic elsewhere (hence increased endpoint activity).
|
| What does Bytedance say regarding all this?
| efitz wrote:
| Two thoughts:
|
| 1. Try using pi-hole to block those particular endpoints via
| making DNS resolution fail; see if it still works if it can't
| access the telemetry endpoints.
|
| 2. Their ridiculous tracking, disregard of the user preference to
| not send telemetry, and behavior on the Discord when you
| mentioned tracking says everything you need to know about the
| company. You cannot change them. If you don't want to be tracked,
| then stay away from Bytedance.
| nosrepa wrote:
| Why use pihole? Most OSes have a hosts file you can edit if
| you're just blocking one domain.
| Zolomon wrote:
| If you have multiple devices on the same LAN, all of them
| will use the pihole.
| 3eb7988a1663 wrote:
| When the nefarious actor is already inside the house, who
| knows to what lengths they will go to circumvent the
| protections? External network blocker is more straightforward
| (packets go in, packets go out), so easier to ensure that
| there is nothing funny happening.
|
| On Apple devices, first-party applications get to circumvent
| LittleSnitch-like filtering. Presumably harder to hide this
| kind of activity on Linux, but then you need to have the
| expertise to be aware of the gaps. Docker still punches
| through your firewall configuration.
| cluckindan wrote:
| Set up your router to offer DNS through pihole and everything
| in your network now has tracking and ads blocked, even the
| wifi dishwasher.
| godelski wrote:
| Even the dishwasher that has Wifi that you don't know has
| Wifi and will happily jump onto open networks or has a deal
| with xfinity
| bangaladore wrote:
| Until everything starts using DoH (DNS over HTTPS). There
| is pretty much no reason to use anything else as a consumer
| nowadays.
|
| In fact, most web browsers are using DoH, so pihole is
| useless in that regard.
| jamespo wrote:
| You can disable that
| efitz wrote:
| Not true, see answer above. Block the domain name or IP
| addresses of the DoH server.
| meindnoch wrote:
| Hate to break it to you, but /etc/hosts only works for apps
| that use getaddrinfo or similar APIs. Anything that does its
| own DNS resolution, which coincidentally includes anything
| Chromium-based, is free to ignore your hosts file.
| gruez wrote:
| But pi-hole seems equally susceptible to the same issue? If
| you're really serious about blocking you'd need some sort
| of firewall that can intercept TLS connections and parse
| SNI headers, which typically requires specialized hardware
| and/or beefy processor if you want reasonable throughput
| speeds.
| neurostimulant wrote:
| I configured my router to redirect all outbound port 53
| udp traffic to adguard home running on a raspberry pi.
| From the log, it seems to be working reasonably enough,
| especially for apps that do their own dns resolution like
| the netflix app on my chromecast. Hopefully they don't
| switch to dns over https any time soon to circumvent it.
| efitz wrote:
| DNS over https depends on the ability to resolve the DoH
| hostname via DNS, which is blockable via PiHole, or
| depend on a set of static IPs, which can be blocked by
| your favorite firewall.
| ses1984 wrote:
| You can't just intercept tls, unless you can control the
| certificate store on the device.
| lowwave wrote:
| Would it also be true for DNS over HTTPS right.
| charcircuit wrote:
| The hosts file doesn't let you properly block domains. It
| only lets you resolve them to something else. It's the wrong
| tool for the job.
| rs186 wrote:
| So that these domains are automatically blocked on all
| devices on a local network. Also, you can't really edit the
| hosts file on Android or iOS, but I guess mobile OSes are not
| part of the discussion here.
|
| Although there are caveats -- if an app decides to use its
| own DNS server, sometimes secure DNS, you are still out of
| luck. I just recently discovered that Android webview may
| bypass whatever DNS your Wi-Fi points to.
| genghisjahn wrote:
| Are there any other companies I should worry about for
| tracking?
| randallsquared wrote:
| Yes.
| dotancohen wrote:
| Meta is pretty much number one, Google is pretty much number
| two. Whoever number three is, they are very far behind.
|
| For what it's worth, I do use Google products personally. But
| I won't go near Facebook, WhatsApp, or Instagram.
| orbital-decay wrote:
| Microsoft is definitely not that far behind in scale. They
| own a ton of software and services that are used by
| basically everyone.
| tojumpship wrote:
| I can also suggest OpenSnitch or Portmaster to anyone whose
| conscious about these network connections. I couldn't live
| without them, never trust opt-outs.
| samgranieri wrote:
| Come on over to neovim, the water is fine. Start with lazyvim if
| you like.
| atoav wrote:
| Gotcha, blacklisting ByteDance.
| isatty wrote:
| Why do people use obvious spyware when free software exists?
| charcircuit wrote:
| Telemetry isn't the same thing as spying on the user. People
| use it because it's not actually spying on them.
| malfist wrote:
| It is literally spying on the user.
|
| Unless you're somehow saying telemetry doesn't report
| anything about what a user is doing to it's home server.
| nomel wrote:
| In my mind, the difference is that spying does or _can_
| contain PII, or PII can be inferred from it, where
| telemetry is _incapable_ of being linked to an individual,
| to a reasonable extent.
| gpm wrote:
| Every single piece of telemetry sent over the internet
| includes PII - the IP address of the sender - by virtue
| of how our internet protocols are designed.
| aleph_minus_one wrote:
| At least spiritually not if the traffic is routed over a
| Tor circuit. :-)
| rvnx wrote:
| Unless you control most of the Tor nodes :-)
|
| So many US universities running such nodes, without ever
| getting legal troubles. Such lucky boys
| nomel wrote:
| > includes PII - the IP address of the sender
|
| Apple provides telemetry services that strips the IP
| before providing it to the app owners. Routing like this
| requires trust (just as a VPN does), but it's feasible.
| charcircuit wrote:
| This is like saying every physical business is collecting
| PII because employees can technically take a photo of a
| customer. It's hard to do business without the
| possibility of collecting PII.
| bayindirh wrote:
| In my mind, any feature collecting information about me,
| truly anonymized or not is spying if it's _opt out_.
| sprdnv wrote:
| I think "spying" implies "everywhere possible",
| including, outside the app
| rvnx wrote:
| Spying and telemetry is not something specific to
| Bytedance. Example: Google ? Or Microsoft ? Why is it a
| problem only when it is Bytedance or Huawei ? For the exact
| same activity
|
| In fact the Chinese entities are even less likely to share
| your secrets to your governement than their best friends at
| Google
| cuuupid wrote:
| No one in the chain of comments you are replying to has
| mentioned anything about Google, and on HackerNews you
| will find the majority sentiment is against spying in all
| forms - especially by Google, Meta, etc.
|
| Even if we interact with your rhetoric[1] at face value,
| there is a big difference between data going to your own
| elected government versus that of a foreign adversary.
|
| [1] https://en.wikipedia.org/wiki/Whataboutism
| rvnx wrote:
| So you are implying at the end that it is better that
| your secrets ("telemetry") go to your local agencies and
| to possible relatives or family who work on Gmail, Uber,
| etc ?
| cuuupid wrote:
| Yes, naturally I trust my own elected government, or
| possible relatives/family, far more than I trust a
| foreign adversary
| inetknght wrote:
| > _Why is it a crime only when it is ByteDance or Huawei
| ?_
|
| It should be a crime for Google as well.
|
| "Whataboutism" is a logical fallacy.
|
| https://en.wikipedia.org/wiki/Whataboutism
| malfist wrote:
| My comment has nothing to do with a specific company but
| about telemetry and spying on the customer.
|
| "What about Google" is not a logical continuation of this
| discussion
| charcircuit wrote:
| If anything it is spying on the application itself. This is
| limited in scope compared to spyware which is software
| which spies on users themselves.
| bayindirh wrote:
| Anonymized or not, opt-out telemetry is plain spying. Go was
| about to find out, and they backed out the last millisecond
| and converted to opt-in, for example.
| nicce wrote:
| Unfortunately opt-in telemetry is like no telemetry at all.
| Defaults matter.
| inetknght wrote:
| No telemetry at all is a good thing to some (most?)
| people.
| nicce wrote:
| Telemetry can be implemented well. The software you use
| gets bugs fixed much faster since you get statistics that
| some bugs have higher impact than others. The more users
| software has, less skills they have in average to
| accurately report any issues.
| inetknght wrote:
| > _The software you use gets bugs fixed much faster since
| you get statistics that some bugs have higher impact than
| others._
|
| Try talking to your users instead.
|
| > _The more users software has, less skills they have in
| average to accurately report any issues._
|
| No amount of telemetry will solve that.
| mnw21cam wrote:
| Surely that should be _fortunately_.
| rs186 wrote:
| Eh, I don't know how you could tell it is "obvious" "spyware",
| unless you are referring to the fact that it comes from
| Bytedance.
| jen20 wrote:
| Have Bytedance produced literally anything to that assumption
| unreasonable?
| phillipcarter wrote:
| Amongst other things they do have a division that produces
| OKR tracking software. Just the weird story of another
| multinational I suppose.
| jen20 wrote:
| As in objective and key result? That's... weird but ok!
| Biganon wrote:
| The mere fact that disabling telemetry does not at all
| disable telemetry is enough for it to be called spyware.
| bowsamic wrote:
| Because there's a huge amount of money behind smearing free
| software
| muppetman wrote:
| Well there's a middle ground - Sublime Text isn't free but it's
| fantastic and isn't sending back all my code/work to the
| Chinese Government. Sorry, "Telemetry"
| quectophoton wrote:
| And the other side of the middle ground, Grafana being AGPL
| but requiring you to disable 4 analytics flags, 1 gravatar
| flag, and _(I think)_ one of their default dashboards was
| also fetching news from a Grafana URL.
|
| https://github.com/grafana/tempo/discussions/5001#discussion.
| ..
|
| (Yes, that's for Grafana tempo, but the issue in
| `grafana/grafana` was just marked as duplicate of this.)
| throwaway328 wrote:
| Yes, why do people use products from Microsoft, Apple, Google,
| Amazon, ...
| davidmurdoch wrote:
| Because the alternatives suck.
|
| In this case, the software being analyzed is the alternative
| that sucks.
| doctorpangloss wrote:
| Ha ha, free software also has tons of telemetry, it just
| belongs to GitHub.
| barkingcat wrote:
| There's also the Eclipse VScode-look-alike-reimplementation
| called TheiaIDE
|
| https://theia-ide.org/
|
| It was rough a few years ago, but nowadays it's pretty nice. TI
| rebuilt their Code Composer Studio using Theia so it does have
| some larger users. It has LSP support and the same Monaco editor
| backend - which is all I need.
|
| It's VSCode-with-an-Eclipse-feel to it - which might or might not
| be your cup of tea, but it's an alternative.
| jeffbee wrote:
| Google Cloud Shell is also Theia. I think it is fairly popular.
| bayindirh wrote:
| Eclipse (as in ecosystem) is fairly popular in Enterprise,
| but since it exposes all the knobs, and is a bona fide IDE
| which has some learning curve, people stay away from it.
|
| Also it used to be kinda heavy, but it became lighter because
| of Moore's law and good code management practices all over
| the board.
|
| I'm planning to deploy Theia in its web based form if
| possible, but still didn't have the time to tinker with that
| one.
| v3ss0n wrote:
| Theia is different from eclipse IDE it's written in JS not
| in Java and didn't share any code base of eclipse which is
| fully Java
| fHr wrote:
| eclipse still is alive holy shit
| andylynch wrote:
| Installing the VSCode extension pack for Java runs a headless
| version of Eclipse JDT under the hood, which isn't quite what
| I think of as lightweight.
| bobajeff wrote:
| The feature that keeps me from moving off of vscode is their
| markdown support. In particular the ability to drag and drop to
| insert links to files and images *. Surprisingly, no other
| editor does this even though I use it all the time.
|
| *
| https://code.visualstudio.com/Docs/languages/markdown#_inser...
| v3ss0n wrote:
| Yeah , INSEAD of forking vscode which is not modification
| friendly they should justuse theia because it is maintained to
| be modular and allowed to be used like a Library to build IDEs
| of your choice.
| Aurornis wrote:
| I see a lot of confused comments blaming Microsoft, so to
| clarify: This analysis is about TRAE, a ByteDance IDE that was
| forked from VSCode: https://www.trae.ai/
| userbinator wrote:
| Arguably it was Microsoft who started the whole trend of
| calling spyware "telemetry" to obfuscate what they were doing.
| tempaccount420 wrote:
| Obfuscate? Telemetry arguably helps with deobfuscation.
| inetknght wrote:
| > _Telemetry arguably helps with deobfuscation._
|
| Can you please expand on that? I have trouble understanding
| how telemetry helps me, as a user of the product,
| understand how the product works.
| chaps wrote:
| Yeah. One of the most frustrating things about modern
| gaming is companies collecting metrics about how their
| game is played, then publishing "X players did Y!" pages.
| They're always interesting, but.... why can't I see those
| stats for my own games?! Looking at you, Doom Eternal and
| BG3.
| tempaccount420 wrote:
| You can capture the telemetry data with a HTTPS MITM and
| read it yourself.
|
| Or (if you're working lower level) you can see an
| obfuscated function is emitting telemetry, saying "User
| did X", then you can understand that the function is
| doing X.
| averageRoyalty wrote:
| I can't prove it, but I think that's untrue. Anecdotally,
| I've only heard MS using it in the last 10 years or so, and
| it's been pretty common terminology for years before that.
| dmezzetti wrote:
| It's interesting that anyone is surprised by this.
| raverbashing wrote:
| Why would anyone use a "Bytedance VSCode fork" is beyond me
| userbinator wrote:
| Except their own employees, of course. Apparently the main
| difference this has with MS' version is additional "AI
| features", so I'm not surprised...
| neurostimulant wrote:
| It's cheap, the ai features cost about half of what other
| editors are charging ($10/mo) and the free tier has generous
| limit. I guess you pay the difference with something else :)
___________________________________________________________________
(page generated 2025-07-27 23:00 UTC)