ByteDance addresses worries about Trae, their variant of Visual Studio Code by Microsoft
ByteDance's Trae, an AI-focused code editor, has been under scrutiny due to persistent telemetry activity and concerns over data privacy.
Recent investigations have uncovered connections to several ByteDance-related endpoints, such as mon-va.byteoversea.com and maliva-mcs.byteoversea.com, with extensive data transfers occurring even when standard telemetry is disabled [1][2][3]. This suggests that various background components or integrated AI and monitoring features within Trae continue to send telemetry independently of the IDE’s telemetry toggle.
One of the troubling issues highlighted in a report by Neowin is the hardcoding of keys and secrets in Trae's code, which could potentially lead to security vulnerabilities [1]. Furthermore, Trae's privacy policy is vague and unclear, raising questions about user data protection.
ByteDance has addressed the report regarding Trae, clarifying that the telemetry settings UI now clearly states that the toggle only controls telemetry data collection via the VS Code IDE framework [1]. However, telemetry collection via other Trae tools remains unaffected by this toggle, with the specific "other Trae tools" yet to be explicitly identified or detailed by ByteDance [1].
The report also points out that Trae hooks into WSL just like Microsoft's version does, and the word "track" is added to a blacklist to prevent discussions about it in the Trae Discord server [1]. Discussions about concerns in the server, including the topic of tracking, are being censored [1].
Coders may want a deeper level of explanation from ByteDance about their practices and policies, particularly regarding the unnamed components or service processes embedded within Trae that continue to send telemetry [1].
In a recent update, the author of the original report has clarified that their ban in the Trae community Discord server was not due to talk of tracking, but a mix-up relating to the use of the word "tokens," apparently in relation to muting talk about Crypto [1].
Trae uses the Open VSX Registry for VS Code-compatible extensions and is a fork of Microsoft's Visual Studio Code, developed by ByteDance, best known as the owner of TikTok [1].
The full report is posted on GitHub by user segmentationf4u1t. The key takeaways from the report are summarized as:
- Trae collects telemetry data via the VS Code IDE framework.
- The word "track" is added to a blacklist to prevent discussions about it.
- Trae hooks into WSL just like Microsoft's version does.
Despite these concerns, Trae does offer visual tweaks that make for a nicer looking experience while editing code. However, it's important for users to be aware of the ongoing telemetry activity and the unclear privacy policy before using the platform.
[1] Source: Neowin report on Trae [2] Source: Investigations into Trae's persistent telemetry activity [3] Source: Discussion censorship in the Trae Discord server
- Coders may also express interest in understanding Microsoft's stance regarding telemetry and data privacy in their Xbox Edge gaming software, given the ongoing debates about similar concerns.
- In the realm of technology, Microsoft has repeatedly updated its software, including Windows 11, to improve user experience and address security vulnerabilities.
- It would be intriguing to explore if Microsoft has implemented a clear telemetry settings policy within its software, such as Xbox Edge, ensuring transparency and user control over data collection.
- As Trae, developed by ByteDance, is a fork of Microsoft's Visual Studio Code, comparisons could be drawn to better understand best practices in terms of telemetry, data privacy, and user control in code editing software.
