Live data from Hacker News

Workspace Trust in VS Code

code.visualstudio.com

11–20 of 25 posts

Re: Workspace Trust in VS Code

#11
post #3

Total anecdata but I don't appreciate the nag screen every time I've opened repos that I have either authored or contributed heavily to... I default to "yes I accept in this directory and all directories" which seems very sketchy in general, but is the easiest for me to get my work done.

This happens even in files I just created or when doing `code ~./zshrc`. It's pretty annoying. I'm a developer, I know what I'm doing. I don't need to be asked whether I trust a Python notebook or not.

Which is kind of ridiculous because .zshrc isn't a workspace. My understanding of this feature was to calm fears of untrusted code running due to some configuration in .vscode configurations or with plugins.

Basically the files and folders are usually innocuous, it's the particular configuration of the workspace or plugins that may run code on them that need to be "trusted" or designed to request permission before executing code

Re: Workspace Trust in VS Code

#12

It's usually a bit silly, yes i trust the author of this directory but I have no clue about the authors under node_modules.

Yeah I think people really underestimate how massive of a security liability node modules are in the way the system currently works.

Fixing it should really be given top priority, but doesn't look to be a very popular subject when you compare it to some of the others such as whether or not ESLint should become a NodeJS core module ...

Re: Workspace Trust in VS Code

#13
post #10
post #8

Based on the first four comments, I see some do not appreciate this unlike me, at least. Just last-night, I was forced to download a zipped folder with source code from a site I was new to. Well, I did appreciate using this new feature because I wasn't sure what I of the 'trustworthiness' of the folder.

If I had to download source in zip format I probably wouldn't touch it outside a VM.

I don't think a ZIP is that much different from a random Git repo...

Re: Workspace Trust in VS Code

#17
> Now, I'm sure many of you will agree, VS Code suffers from a bit of what we call "Notification Fatigue"

Yup.

I love VS Code but the sheer amount of chatty notifications especially when browsing a large code base can be simply overwhelming. I just start reflexively ignoring them. There’s no “just shut up already and let me work” button.

I’m glad this is something they are working on improving.

Post reply on HN