{"id":14971,"date":"2021-02-04T08:34:16","date_gmt":"2021-02-04T16:34:16","guid":{"rendered":"https:\/\/www.privateinternetaccess.com\/blog\/?p=14971"},"modified":"2024-01-25T23:29:37","modified_gmt":"2024-01-26T07:29:37","slug":"users-have-privacy-concerns-about-microsofts-inclusion-in-raspberry-pi-os","status":"publish","type":"post","link":"https:\/\/www.privateinternetaccess.com\/blog\/users-have-privacy-concerns-about-microsofts-inclusion-in-raspberry-pi-os\/","title":{"rendered":"Users have privacy concerns about Microsoft’s inclusion in Raspberry Pi OS"},"content":{"rendered":"

An unannounced update to Raspberry Pi OS has added Microsoft\u2019s GPG key and apt repository for VSCode to the popular operating system previously known as Raspbian which is used on millions of Raspberry Pi devices around the world. What this means is that every time a Raspberry Pi OS user types \u201capt-get update,\u201d they\u2019ll be pinging Microsoft\u2019s servers. This \u201cupgrade\u201d was made as part of Raspberry Pi OS\u2019s embracing of Microsoft\u2019s IDE for VSCode; however, a growing amount of backlash which has been censored on the official Raspberry Pi support forums suggests that the Raspberry Pi Foundation has moved a little too fast and broken one thing they shouldn\u2019t break: the trust of Linux users and the open source community which has long held biases against Microsoft<\/a> based simply on track record.<\/p>\n

Surprise: Linux users don\u2019t like pinging Microsoft servers<\/h2>\n

On the official Raspberry Pi forum, feedback was largely ignored and civil discourse was disrupted by the moderators. As a result, the Linux subreddit<\/a> ended up being a much better mirror into the minds of actual Raspberry Pi users. In the original post, the original poster highlights the issue with Raspberry Pi OS trusting Microsoft\u2019s GPG key:<\/p>\n

\u201cThey also install Microsoft\u2019s GPG key used to sign packages from that repository. This can potentially lead to a scenario where an update pulls a dependency from Microsoft\u2019s repo and that package would be automatically trusted by the system.\u201d<\/p><\/blockquote>\n

One redditor, CAP_NAME_NOW_UPVOTE<\/a>, succinctly described in a stickied comment why having the Microsoft repo automatically included into an OS is a problem:<\/p>\n

\u201cBy having this repo, every time a Raspbian [Raspberry Pi OS] machine is updated it will ping a Microsoft server. Microsoft will know you\u2019re using Raspberry Pi OS\/likely Raspberry Pi owner and your IP address. Many people try to reduce footprint as much as possible, so these are three additional datapoints Microsoft can use to build a profile about you. If you\u2019re logged into a Microsoft service, use Bing, or even pull something from GitHub they can \u201cidentify\u201d you as a Raspberry Pi OS\/likely Raspberry Pi owner and influence ads, among other possibilities. Arguably (but small) this could be considered an ad itself for VSCode.\u201d<\/p><\/blockquote>\n

It\u2019s worth pointing out that in this day and age, pinging Microsoft servers is likely to happen whether you\u2019re using Raspberry Pi OS or not\u2026 Such as when you download a repo from Github.<\/p>\n

Microsoft repo sneakily added to Raspberry Pi OS<\/h2>\n

It\u2019s entirely within the Raspberry Pi Foundation\u2019s rights to add code to their operating system, especially in the name of education<\/a>. What privacy conscious onlookers seem to have an issue with, is the simultaneously fly-by-night and tonedeaf way that this happened.<\/p>\n

Another redditor, idontreallycaredou<\/a>, addressed this aspect in a comment:<\/p>\n

\u201cI don\u2019t believe that the action of making Microsoft products available to Raspberry Pi users is wrong; I simply don\u2019t agree with the heavy-handed approach by the Raspberry Pi developers (primarily gsh and jamesh, based on the conversation threads). They seem to be ignorant of the GNU \/ open source clauses that apply to Raspbian \/ Debian and are closed to any suggestion of giving users a chance to explicitly opt out. I\u2019m curious as to whether there\u2019s some way to raise an appeal with the Raspberry Pi foundation, as they seem to be fairly reasonable.\u201d<\/p><\/blockquote>\n

Eben Upton, the founder of Raspberry Pi, responded to questions about the Microsoft repo inclusion on Twitter:<\/p>\n

\n

Sorry: I can't understand why you think this was a controversial thing to do. We do things of this sort all the time without putting out a blog post about how to opt out.<\/p>\n

\u2014 Eben Upton (@EbenUpton) February 3, 2021<\/a><\/p><\/blockquote>\n