Live data from Hacker News

Threat actors expand abuse of Microsoft Visual Studio Code

jamf.com

21–30 of 306 posts

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#21

It is scary that a text editor can run hidden code just by opening a folder. We traded our safety for convenience and now we are paying the price. Users will always click the button to trust a file if they think it helps them work faster. We cannot blame them when the software design makes it so easy to make a mistake.

> We traded our safety for convenience

Not the first time. Same with LLMs.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#22
post #15

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

> Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Is eclipse good now? I used it 15 years ago. It took ages to start. It was a memory hog and it was dog slow besides. My entire team got RAM upgrades on our computers because the default company issued machines (which were quite good at the time) didn't have enough RAM to use eclipse properly. I can't imagine why it went out o…

How much ram did you have, and when was this? I remember being extremely happy with Eclipse on an 8GB machine - this was back in the jvm7 days. Heck, I did jvm6 development with Eclipse on Windows XP with 4GB of ram and was content.

Eclipse gets a lot of automatic hate - I believe mostly since a lot of people first use it in university and struggled with their first real IDE.

For years and years I had people telling me how great IntelliJ was, etc. I eventually switched - lo and behold, IntelliJ had just as many quirks (even some of the same) as Eclipse.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#23

Earlier quoted context omitted.

That is a massive red flag to me too. They are basically saying "you are identical to everyone else, and easily replaced."

Wanting to be able to use anybody's machine is very strange, agreed. From a support/IT perspective though, the closer everybody's machine is, the easier the job is. The last software shop I worked at, we had a default set of tools and configs. It was a known happy path. You were allowed to adventure off of that path, but you were mostly on your own.

Devcontainers[1] or some similar technology are a must. Use whatever specific IDE you want, but the development environment itself should be identical across everyone on the team.

No more "works on my computer" issues. The environment is always identical.

[1] https://containers.dev/

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#24
post #22
post #15

Earlier quoted context omitted.

> Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Is eclipse good now? I used it 15 years ago. It took ages to start. It was a memory hog and it was dog slow besides. My entire team got RAM upgrades on our computers because the default company issued machines (which were quite good at the time) didn't have enough RAM to use eclipse properly. I can't imagine why it went out o…

How much ram did you have, and when was this? I remember being extremely happy with Eclipse on an 8GB machine - this was back in the jvm7 days. Heck, I did jvm6 development with Eclipse on Windows XP with 4GB of ram and was content. Eclipse gets a lot of automatic hate - I believe mostly since a lot of people first use it in university and struggled with their first real IDE. For years and years I had people telling…

I used eclipse in university around that time (2005), then first switched to netbeans which I already liked more, then discovered IntelliJ and have been using that ever since. Everything about Eclipse felt worse in ways neither of the others did, but all of that was still during university (though I now use JetBrains professionally).

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#25
post #8

Earlier quoted context omitted.

Doesn't it ask you if you trust a folder when you open it?

You are right that the computer asks you. But people click yes because they are used to ignoring warning signs. The software relies on people making perfect choices every time and that never happens.

It should tell me what should I look before I trust it. Not trusting the workspace means I might as well use Notepad to open it. I wouldn't think that tasks.json include autorun tasks in addition to build actions.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#26

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

I’ve never written a line of Java in my life. Why would I ever use Eclipse?

VSCode is defacto standard because it’s kinda mediocre but works ok enough for every language and every platform. Microsoft created and popularized LSP so VSCode isn’t a single language IDE.

I use a mixture of code editors. My favorite is probably 10x but it only works with C++. So VSCode is just a reasonably standard unless a different editor is better for a specific use case.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#28
post #16

Earlier quoted context omitted.

why is VS code the defacto answer nowaday? 1. It's free 2. A million plug-ins Personally, I don't use it because it's so dog slow.

> A million plug-ins > I don't use it because it's so dog slow. You might find it runs better with fewer plugins.

Load time is in seconds, even with the program cached. I can still load vim with a ton of plugins[0] and still load a project in a few hundred milliseconds.

Maybe VS Code is faster with fewer plugins but it's still "dog slow" to load and run. Only thing I'm "missing" in vim is the bloat

[0] personal I only use a handful but I've played around because why not

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#30

Earlier quoted context omitted.

Seems very odd to me that someplace would force the use of a particular development tool. I've seen it only one time while interviewing, where they wanted everyone to have identical setups so they could easily hop onto each others computers when needed... it was weird and I took it as a red flag and didn't follow through them them.

That is a massive red flag to me too. They are basically saying "you are identical to everyone else, and easily replaced."

It's quite common if you work in a team of engineers, or in a large company with many engineers.

Having consistent machine and OS and app configurations enables better (lower cost, higher reliability) scripting and tooling solutions in things like repos and infrastructure.

Not unlike consistency in language and compiler choices.

Post reply on HN