My current phone runs an OS I compiled myself; nearly every app on it was also compiled by me. My computer runs Linux.
This isn’t about tinkering for fun — it’s something very simple: files are on my machine, and the decision of whether to let someone take them, who gets to see them, how long they’re kept — that decision must be in my hands.
Let me put this upfront: these big tech companies are no different from thugs.
1. What ZCode Did Is the Same Thing as the 3Q War Fifteen Years Ago
The problem developers caught ZCode doing, summarized in one sentence: without notifying users, and without a genuine off-switch, the entire workspace — including years of complete Git history — was packaged and uploaded to the cloud.
For people who write code, what this means doesn’t need elaboration. Unreleased commercial projects, client-delivered code, keys still sitting in repositories, years of commit history — all in that directory. The moment files are read and uploaded, the user has no idea.
This isn’t a new problem. The 2010 “3Q War” — two companies brawling inside my computer — ultimately forced me to choose: install this one or that one, not both. The reasons all sounded noble: for user security.
Back then, the battlefield was my computer. Now the mine is my code repository. Fifteen years apart, what’s being disposed of has always belonged to someone else.
2. This Approach Was Nurtured by the Free Model
The origin is clear. Early internet products were given away free; since the product doesn’t charge, something else has to pay the bill — ultimately it’s users’ attention and data.
In scenarios like scrolling short videos or reading news, I can grudgingly accept this cost. But code and commercial secrets are an entirely different matter: watching a few ads versus having someone copy my project’s source code and store it on their server — these two things cannot be placed on the same scale.
3. I Paid, and I’m Still Treated as Shelf Space
Amap plays an ad while you’re navigating; shake your phone slightly and it jumps to another app — this “shake-to-open” splash-screen trick is all too familiar to domestic users and virtually nonexistent abroad.
I’m not against ads. Products need to survive, servers cost money, people need salaries — monetizing through advertising is a normal business choice, and I understand that.
What I resent is something else: having already taken users’ money, then taking advertisers’ money again. Domestic music and video platforms operate exactly this way — you buy a membership, open the app, and there are still ads: before the content, during the content. Want them completely gone? Pay more for a higher tier. Compare this with Apple Music: ten yuan a month, pay once and listen in peace, no ads inserted. Both are paid products; the difference isn’t technical.
Look at those high salaries big companies offer — where does the money come from? One side is my membership fees, the other is advertisers’ budgets — both sides are scraped from users. This money shouldn’t be earned this way in the first place; earning it this way is earning it without conscience.
4. My Information Was Sold This Way Too
There’s another thing I’ve never been able to figure out: real-name registration has been pushed for so many years, yet fraud has only gotten worse.
This is my lived experience, not a statistical conclusion. But these past few years, scammers’ knowledge of me exceeds that of many companies currently serving me — address, phone number, how many people in my household, where I work — they can rattle it all off instantly.
Information must have an exit point. My apartment here hasn’t even been delivered yet, and calls from real-estate agents, rental agencies, and renovation companies already arrived. Who could have obtained that list at that point in time, other than the property management and the developer? I can’t think of anyone else.
What I suspect: after real-name registration, this information concentrated into the hands of a few holders — before, everyone kept their own piece; now someone can assemble them into a complete profile. Once assembled, if anyone is willing to trade it for money, what’s sold isn’t one item — it’s everything.
Ten years ago, accomplishing this would have required equipment, manpower, and extensive time. Now in the era of AI and big data, cleaning, merging, and profiling scattered names, phone numbers, addresses, household sizes, and workplaces costs virtually no effort. Those with computing power, data, and legal teams on payroll are typically large corporations and big capital.
In their eyes, everyone at the bottom is fish and meat.
5. This Isn’t Something Only Domestic Companies Do
That said, I don’t agree with framing this as “domestic companies are inherently thieves” — it’s neither accurate nor fair.
On advertising, domestic companies are indeed more aggressive — that’s undeniable. But “uploading data without notification” happens overseas too — foreign AI coding tools have stumbled on similar issues; reports mention xAI’s Grok Build and Claude Code. The difference lies elsewhere: over there, when developers encounter this, packet capture, auditing, and public confrontation are standard moves — companies can’t easily paper over it. Domestically, people willing to do this have only gradually increased in recent years. The gap isn’t moral standards — it’s the time lag in oversight.
The industry isn’t monolithic either. After 3Q, with anti-monopoly enforcement and the Personal Information Protection Law taking effect, many big companies genuinely implemented data-access management and privacy audits internally; in the open-source community and enterprise-tool space, teams exist that from day one only work locally and never transmit data.
What truly alarms me is something else: this round of AI, in the race for speed and results, has revived the old habit of “collect the data first, disclose later.”
6. Overseas, This Approach Hits a Wall Immediately
Overseas developers evaluating a tool look first not at feature strength but at whether a fundamental boundary has been breached: local things stay local; the tool only touches what’s strictly necessary for the current task; if uploading is required, it must be clearly disclosed with a working off-switch.
Domestically, crossing the line means issuing an announcement, shipping a fix, and things usually blow over. Going overseas means facing GDPR and trade-secret law; reputation in developer circles spreads fast, and one failure can be terminal. No matter how good the product is, crossing this line means no second chance.
7. Why I Replaced Everything I Use with Self-Compiled Software
Closed-source software is a black box: what it reads, where it transmits, how long it retains — I can’t see any of it; I can only trust its documentation. This trust is one-directional; interpretation rights belong to them.
Open-source things are at least sitting right there. I can check whether they’re secretly reading my files or transmitting behind my back. When compiling myself, analytics modules and tracking code I don’t want simply don’t get compiled in — data stays on the local machine. The costs are real: interfaces aren’t as polished, updates are manual, features may be missing, and when something breaks you either read the code yourself or wait for the community to fix it. I’m trading that inconvenience for having the final say.
8. This Path Has Its Own Pitfalls
First, open-source doesn’t equal secure. Repositories can be poisoned; dependencies can contain vulnerabilities. What I compile matching the source code I read doesn’t mean that source code itself is problem-free.
Second, beneath my feet is a layer I can’t touch. Phone firmware, baseband, low-level drivers — still closed-source. Even replacing every app with self-compiled versions, the bottommost layer is still written by others. Projects like GrapheneOS are doing their best to shrink this layer.
Third, the cost is ongoing. Syncing source code, recompiling, fixing dependencies, tracking new versions — when busy, it’s easy to fall six months behind. This isn’t a one-time-setup hobby.
But even so, I’m still willing to pay this price.
9. Two Premises
Laying this all out, underneath are two premises.
One premise: users are themselves the raw material of the business; the service is merely the channel for converting raw material back.
The other premise: users are customers; tools are just tools; whose data it is and how it’s handled is decided by the users themselves.
The difference between the two isn’t technical — it’s about what the person sitting across from you is treated as.
The ZCode incident at minimum reminds domestic AI-coding-tool makers of one thing: when building these tools, the first rule to follow isn’t model capability — it’s respecting other people’s code boundaries.
Until that changes, I’ll keep compiling my own. Phone included. Computer included.
评论
0 条评论