Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Threat actors expand abuse of Microsoft Visual Studio Code

jamf.com

Post reply on HN
Print view View original

11–20 of 306 posts

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#11

Post by dfajgljsldkjag »

TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

Eclipse is not safer it just has fewer people looking for holes in it. The problem is not the software but how we trust code from the internet. Even if you used Eclipse a fake recruiter could still trick you into running a bad script. We cannot fix social engineering by changing the text editor.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#12

Post by mr_toad »

TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

> Im guessing the answer is probably Java is why eclipse is out of favor.

Some people just want a text editor, whereas eclipse is “an IDE and Platform”.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#13

Post by jen20 »

doodlesdev wrote: post #4
TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

> everything seems worse than eclipse I would say the answer is that's not the general perception of the software. I'm personally migrating out of VSCode, because having to use the OpenVSX registry to have open-source builds makes me mad (I've since migrated to Zed for now, since I've never adapted well to neovim nor emacs). In general, I believe most people see VSCode as "good enough". Maybe not the best text editor…

“Java” does not explain why Eclipse is irrelevant where IntelliJ is thriving.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#14

Post by dfajgljsldkjag »

EE84M3i wrote: post #8
dfajgljsldkjag wrote: post #7

It is scary that a text editor can run hidden code just by opening a folder. We traded our safety for convenience and now we are paying the price. Users will always click the button to trust a file if they think it helps them work faster. We cannot blame them when the software design makes it so easy to make a mistake.

Doesn't it ask you if you trust a folder when you open it?

You are right that the computer asks you. But people click yes because they are used to ignoring warning signs. The software relies on people making perfect choices every time and that never happens.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#15

Post by josephg »

TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

> Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays?

Is eclipse good now? I used it 15 years ago. It took ages to start. It was a memory hog and it was dog slow besides. My entire team got RAM upgrades on our computers because the default company issued machines (which were quite good at the time) didn't have enough RAM to use eclipse properly.

I can't imagine why it went out of favour...

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#16

Post by josephg »

reaperducer wrote: post #5
TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

why is VS code the defacto answer nowaday? 1. It's free 2. A million plug-ins Personally, I don't use it because it's so dog slow.

> A million plug-ins

> I don't use it because it's so dog slow.

You might find it runs better with fewer plugins.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#17

Post by mmh0000 »

dfajgljsldkjag wrote: post #7

It is scary that a text editor can run hidden code just by opening a folder. We traded our safety for convenience and now we are paying the price. Users will always click the button to trust a file if they think it helps them work faster. We cannot blame them when the software design makes it so easy to make a mistake.

Tooooo be fair

Vim had also had its share of execution vulnerabilities over the years.

https://github.com/numirias/security/blob/master/doc/2019-06...

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#19

Post by doubled112 »

userbinator wrote: post #10
eikenberry wrote: post #6

Earlier quoted context omitted.

Seems very odd to me that someplace would force the use of a particular development tool. I've seen it only one time while interviewing, where they wanted everyone to have identical setups so they could easily hop onto each others computers when needed... it was weird and I took it as a red flag and didn't follow through them them.

That is a massive red flag to me too. They are basically saying "you are identical to everyone else, and easily replaced."

Wanting to be able to use anybody's machine is very strange, agreed.

From a support/IT perspective though, the closer everybody's machine is, the easier the job is.

The last software shop I worked at, we had a default set of tools and configs. It was a known happy path. You were allowed to adventure off of that path, but you were mostly on your own.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#20

Post by croes »

userbinator wrote: post #10
eikenberry wrote: post #6

Earlier quoted context omitted.

Seems very odd to me that someplace would force the use of a particular development tool. I've seen it only one time while interviewing, where they wanted everyone to have identical setups so they could easily hop onto each others computers when needed... it was weird and I took it as a red flag and didn't follow through them them.

That is a massive red flag to me too. They are basically saying "you are identical to everyone else, and easily replaced."

Or they bust don‘t want to look after a dozen different tools and their security issues.
Post reply on HN