microsoft / microsoft/TypeScript

Editors need a way to determine whether they are talking to an official TS Server

Open
#40,310 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Infrastructure
Dominant language
Go
Stars
111k
Forks
14.3k
Avg merge
2d 4h
Merged PRs (30d)
132

Description

Otherwise, they will obliviously forward events from the server to our official telemetry system and we'll have confusing noise in our data (e.g. stacks that don't match our source or asserts that don't exist).

The most secure approach would be to cryptographically hash the official tsserver.js and have the editor only report telemetry for matching files. This would likely be impractical for, e.g., nightly builds. Edit: @minestarks pointed out that signing the files would be a smarter way to do this - no need for a big inclusion list.

An intermediate approach would be to only report telemetry from the in-box implementation (i.e. not if tsserver comes from npm or nuget). We might lose a lot of data.

Alternatively, our publication process could modify tsserver.js in some way that the editor could detect. A fork would have to be deliberately malicious to replicate the change (vs now, where they'd have to explicitly suppress events to be good citizens).

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with tsserver.js and the publication process; the issue names no specific tests or other entry points. Compare the proposed identity mechanisms and determine how an editor can reliably recognize official servers before forwarding telemetry, including nightly or npm/nuget distributions. Done means telemetry is reported only for verifiably official servers.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
developer-experience, observability, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.