Threat actors expand abuse of Microsoft Visual Studio Code • Hacker News Board

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#41

Post by someguyiguess » Thu, Jan 22, 2026, 4:49 AM UTC

josephg wrote: post #15

TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

> Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Is eclipse good now? I used it 15 years ago. It took ages to start. It was a memory hog and it was dog slow besides. My entire team got RAM upgrades on our computers because the default company issued machines (which were quite good at the time) didn't have enough RAM to use eclipse properly. I can't imagine why it went out o…

This is exactly what I was going to say. I used eclipse in college when learning Java. Back then it was bloated, slow, had really bad UX, and would occasionally crash for no reason I could ascertain (I was just doing basic school projects. Linked lists, binary search trees, etc...)

VS Code, although it is starting to go get a bit bloated, has always been extremely responsive and snappy. Yeah I've had it crash, but I was never surprised that it crashed. (e.g. opening enormous files, running several instances at once with tons of tabs open, long debugging sessions, etc...)

But now I use NeoVim so none of that matters...

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#42

Post by atq2119 » Thu, Jan 22, 2026, 4:51 AM UTC

TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

My personal reason for switching some years ago was the excellent remote session support via ssh.

I haven't reevaluated that choice in a while, but that plus LSP support (and to a lesser extent ML Auto-complete) are must-haves for me nowadays.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#43

Post by MaulingMonkey » Thu, Jan 22, 2026, 4:52 AM UTC

doubled112 wrote: post #19

userbinator wrote: post #10

Earlier quoted context omitted.

That is a massive red flag to me too. They are basically saying "you are identical to everyone else, and easily replaced."

Wanting to be able to use anybody's machine is very strange, agreed. From a support/IT perspective though, the closer everybody's machine is, the easier the job is. The last software shop I worked at, we had a default set of tools and configs. It was a known happy path. You were allowed to adventure off of that path, but you were mostly on your own.

> Wanting to be able to use anybody's machine is very strange, agreed.

Very useful if people are struggling to create reliable repro steps that work for me - I can simply debug in situ on their machine. Also useful if a coworker is struggling to figure something out, and wants a second set of eyes on something that's driving them batty - I can simply do that without needing to ramp up on an unfamiliar toolset. Ever debugged a codegen issue that you couldn't repro, that turned out to be a compiler bug, that you didn't see because you (and the build servers) were on a different version? I have. There are ways to e.g. configure Visual Studio's updater to install the same version for the entire studio, which would've eliminated some of the "works on my machine" dance, but it's a headache. When a coworker shows me a cool non-default thing they've added a key binding for? I'll ask what key(s) they've bound it to if they didn't share it, so we share the same muscle memory.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#44

Post by Avicebron » Thu, Jan 22, 2026, 4:53 AM UTC

TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

The only thing that matters is extensibility/customization and speed. I want the lightest, most customizable thing that isn't emacs (for real reasons, trying to set up emacs at work is too much of pain in the ass) as my single pane of glass on any OS I care to use. If it can't do that, it doesn't live long.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#45

Post by jonwinstanley » Thu, Jan 22, 2026, 4:57 AM UTC

TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

As I remember it, VS code was Microsoft’s response to Sublime.

Sublime was exceptionally popular for web developers throughout the 2010s.

Sublime was maintained by a single person as far as I know.

VS code was pretty much a copy of Sublime but with a much better extensions system and relatively quickly there were some great plugins that made VS code the de-facto editor for web development.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#46

Post by ryukoposting » Thu, Jan 22, 2026, 5:00 AM UTC

josephg wrote: post #15

TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

> Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Is eclipse good now? I used it 15 years ago. It took ages to start. It was a memory hog and it was dog slow besides. My entire team got RAM upgrades on our computers because the default company issued machines (which were quite good at the time) didn't have enough RAM to use eclipse properly. I can't imagine why it went out o…

> It took ages to start. It was a memory hog and it was dog slow besides. My entire team got RAM upgrades

The more things change, the more they stay the same. I used to use VS Code on some very large C projects with 16GB of RAM, and my machine would grind to a halt while intellisense was indexing.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#47

Post by [deleted] » Thu, Jan 22, 2026, 5:01 AM UTC

SV_BubbleTime wrote: post #3

TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

Wild. I would quit my job and start selling jam at the Farmer’s Market before I went back to Eclipse! :)

[deleted]

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#48

Post by rapind » Thu, Jan 22, 2026, 5:09 AM UTC

Avicebron wrote: post #44

TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

The only thing that matters is extensibility/customization and speed. I want the lightest, most customizable thing that isn't emacs (for real reasons, trying to set up emacs at work is too much of pain in the ass) as my single pane of glass on any OS I care to use. If it can't do that, it doesn't live long.

I want the lightest, most customizable thing, that is also Vim. Thank god there's Vim for that. (cloning my dotfiles for instant setup on a new box)

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#49

Post by blackoil » Thu, Jan 22, 2026, 5:10 AM UTC

TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

Because it is fast enough, easy to onboard to with sane defaults. MS provided initial plug-ins and the ecosystem developed.

Threat model described is not unique to VS Code

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#50

Post by josephg » Thu, Jan 22, 2026, 5:12 AM UTC

Alupis wrote: post #22

josephg wrote: post #15

Earlier quoted context omitted.

> Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Is eclipse good now? I used it 15 years ago. It took ages to start. It was a memory hog and it was dog slow besides. My entire team got RAM upgrades on our computers because the default company issued machines (which were quite good at the time) didn't have enough RAM to use eclipse properly. I can't imagine why it went out o…

How much ram did you have, and when was this? I remember being extremely happy with Eclipse on an 8GB machine - this was back in the jvm7 days. Heck, I did jvm6 development with Eclipse on Windows XP with 4GB of ram and was content. Eclipse gets a lot of automatic hate - I believe mostly since a lot of people first use it in university and struggled with their first real IDE. For years and years I had people telling…

It was 2010. Our default work machines had 16gb of ram. Eclipse ran, but it was tight. Especially while debugging. Some developers also apparently liked to open a second eclipse instance for some reason. You'd go OOM pulling stunts like that.

They upgraded all of us to 32gb. 32gb doesn't sound like a lot of ram now, but in 2010 it seemed pretty wild to me. Especially for just running an IDE.

In eclipse's defence, we were working on a very large java codebase. But that shouldn't have been a surprise to anyone. I've never seen a java codebase come in any other size.

I'm running intellij (RustRover) right now, and its sitting on about 4.5gb of ram. That still seems very inefficient to me. But it doesn't sound that bad compared to eclipse.