Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

parsiya.net

Post reply on HN
Print view View original

71–80 of 109 posts

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#71

Post by jodrellblank »

azalemeth wrote: post #61

The "Your editor has DRM" section alone [0] is enough for me to continue to advocate for a better user-friendly FOSS IDE, in addition to the wonderful giants of emacs & vim, and to avoid the VS Code "kool aid". [0] https://parsiya.net/blog/2021-12-20-rce-in-visual-studio-cod...

VS Code is MIT Licensed - https://github.com/Microsoft/vscode

Arguably the MIT license gives you more Freedom than the GPL'd Linux kernel or GNU utilities. Trying to draw a distinction between "evil user-unfriendly Microsoft stuff" and "Holy Saviour FOSS" is not meaningful anymore.

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#72

Post by throw10920 »

azalemeth wrote: post #61

The "Your editor has DRM" section alone [0] is enough for me to continue to advocate for a better user-friendly FOSS IDE, in addition to the wonderful giants of emacs & vim, and to avoid the VS Code "kool aid". [0] https://parsiya.net/blog/2021-12-20-rce-in-visual-studio-cod...

Emacs' TRAMP is remote-access like VSCode server - except in addition to being completely open-source, it also doesn't require that you install anything on the server, which ranges from being annoying to a show-stopper in corporate environments.

However...I love Emacs, but as much as I hate to admit it, VSCode's out-of-the-box experience is significantly better than even starter kits like Doom and Spacemacs ):

VSCode is far more "user-friendly" than Emacs or Vim at this point in time. That's definitely something that can be changed, but let's not delude ourselves...

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#73

Post by throw10920 »

jodrellblank wrote: post #71
azalemeth wrote: post #61

The "Your editor has DRM" section alone [0] is enough for me to continue to advocate for a better user-friendly FOSS IDE, in addition to the wonderful giants of emacs & vim, and to avoid the VS Code "kool aid". [0] https://parsiya.net/blog/2021-12-20-rce-in-visual-studio-cod...

VS Code is MIT Licensed - https://github.com/Microsoft/vscode Arguably the MIT license gives you more Freedom than the GPL'd Linux kernel or GNU utilities. Trying to draw a distinction between "evil user-unfriendly Microsoft stuff" and "Holy Saviour FOSS" is not meaningful anymore.

Some parts of VSCode are MIT Licensed - not all of it, and in particular, parts of the standard VSCode that almost everybody downloads are straight-up proprietary, per the article[1].

[1] https://parsiya.net/blog/2021-12-20-rce-in-visual-studio-cod...

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#75

Post by nitrogen »

dboreham wrote: post #63
ectopod wrote: post #48

Earlier quoted context omitted.

No, JavaScript running in your browser can connect to it. No remote access required. Of course, if you do allow remote access it is even worse.

Wait, the browser allows random http connections to localhost from JS fetched from any domain?? Edit: after reading tfa, it appears: no it can't , but it may due to browser security vulnerabilities.

Do browsers block access to 192.168/16 or 10/8 etc?

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#76

Post by withinrafael »

easton wrote: post #51
2ion wrote: post #41

In a sense Microsoft forgot its own learnings. Because of exactly things like this they prevent UWP apps from connecting to localhost by default and make it very annoying to circumvent and from my experience, the circumvention is not exactly a stable setup. So they really don't want you to do that, and somebody thought enough to make it extra difficult. So, they have UWP, all those well thought-out policies, then mak…

Apps installed from the Microsoft Store are no longer guaranteed safe, as Win32 apps can be added to the store now and installed via winget. There’s static analysis and they run the installer, but if it does something stupid after the install they can’t automatically detect it.

And it was unsafe for a few years prior to this event too, with the introduction of Desktop Bridge apps (packaged Win32 hybrid apps running with full trust).

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#77

Post by vorpalhex »

azalemeth wrote: post #61

The "Your editor has DRM" section alone [0] is enough for me to continue to advocate for a better user-friendly FOSS IDE, in addition to the wonderful giants of emacs & vim, and to avoid the VS Code "kool aid". [0] https://parsiya.net/blog/2021-12-20-rce-in-visual-studio-cod...

VSCodium is a FOSS build of the MIT VSCode repo, with an alternate FOSS compliant extension source. Note that some fancy extensions are missing, but otherwise works 100%. I have been using VSCodium as my main IDE for about a year now.

https://vscodium.com/

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#78

Post by [deleted] »

nostoc wrote: post #56
_wldu wrote: post #44

Earlier quoted context omitted.

I do agree that bug bounties are too small, but isn't selling bugs on the black market illegal? I would much rather get $40 dollars for a bug and some public acknowledgement (which I could use to get a better paying job) than to sell it for criminal use.

How about selling legally to a state actor for 100k ? Bug bounties need to be higher, because the black market is not the only alternative.

[deleted]

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#79

Post by AntonyGarand »

dboreham wrote: post #63
ectopod wrote: post #48

Earlier quoted context omitted.

No, JavaScript running in your browser can connect to it. No remote access required. Of course, if you do allow remote access it is even worse.

Wait, the browser allows random http connections to localhost from JS fetched from any domain?? Edit: after reading tfa, it appears: no it can't , but it may due to browser security vulnerabilities.

It does, if the server accepts the connection there is nothing preventing it.

This is frequently used by apps which are installed on your machine but are accessed by links, such as zoom and discord. I think Zoom removed its server after receiving pressure[0] about it, but discord still does it: Head to https://discord.com/invite/test and it should open your local discord client, or checking the network requests will reveal up to 10 attempted local ports.

[0] https://www.zdnet.com/article/zoom-defends-use-of-local-web-...

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#80

Post by kube-system »

ensignavenger wrote: post #60
darkwater wrote: post #50

Earlier quoted context omitted.

> but isn't selling bugs on the black market illegal? Noob question: is there any specific law that punishes describing how to get into a software/electronic system but not actually doing it? Something that is just not purely US-centric.

Here is UK specific answer, and as they point out, if you sell to some one knowing they are going to commit a crime with it, you can be considered an accomplice in many jurisdictions. https://law.stackexchange.com/questions/11552/is-it-illegal-...

Sounds like a market opportunity for middlemen in other jurisdictions.
Post reply on HN