"(...) every time an install of Raspberry Pi OS is updated it will ping a Microsoft server. Microsoft will know you're using Raspberry Pi OS/likely Raspberry Pi owner and your IP address."
How is this is an issue? It doesn't require any login and this is exactly what happens with every APT mirror.
I imagine that Raspberry Pi OS is an distro meant for people who simply want things to work out of the box, I can see why the Raspberry foundation would want to add repos for easy installation of the VSCode.
If you want tight control of what happens in your system, you are free to install any other distro you want.
Yes, but it's you who usually manage those mirrors, not some guy deciding which mirrors your apt must query now and pushing it in a regular update without notice.
I don't care if it's Microsoft or some obscure Chinese repo, but I think nobody should mess with your mirrors list or trust their keys in this way.
That's not true for most people.
What's wrong with communicating this change or making it opt-in?
Randomly pushing repos and adding trusted keys without any notice or consent is never a cool move.
- The RPi Foundation exists to educate children. There is no mention of "open" on their About page and there are the long running discussions about how open their hardware is and the reliance on proprietary blobs for the GPU [0]
- The 'maker' community interest was originally a surprise to them [1] which still staggers me given that Arduino had long been a thing
- MS has a history of capturing the budgets of educators and attention of young minds. The education computer market in the UK used to be dominated by Acorn and Apple until MS decided they wanted a piece of the pie and decided that computer education in schools should be about learning to use Office [2]
[0] https://www.raspberrypi.org/about/
[1] https://www.jbs.cam.ac.uk/insight/2012/raspberry-pi-2/
[2] https://www.cbronline.com/news/acorn_backs_away_from_uk_educ...
Lets keep in mind that the central goal of PI OS is education, not security, privacy, sticking it to corporates, IoT, etc.
There is no real iot-style security in Raspbian lite, so before you get mad pver microsoft eepo being added, toy should be sorting that out
So yes, in fact, it's quite true.
After almost a decade of gaining trust, Raspbian has now lost a huge amount in a single bad decision. It's yet even clear they even understand the depth of the mistake.
For future Raspberry Pi deployments, I will be sticking with non-Raspbian distributions, like vanilla Debian.
