Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Threat actors expand abuse of Microsoft Visual Studio Code

jamf.com

Post reply on HN
Print view View original

51–60 of 306 posts

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#51

Post by danielodievich »

com2kid wrote: post #31
TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

I switched to VSCode because it has a free editor with a really great jump to file hotkey. I remember when the big VS added jump to file but it was so damn miserably implemented as to be useless. Having worked at Microsoft for a decade, the most frequent way I navigated a large source tree was dir /s *partialfilename*.* Then again while I was there, most code bases couldn't even open in Visual Studio. (highly team de…

Site license to source insight was something I missed badly after Microsoft. Bought my own copy. It did wonders when looking at Snowflake monorepo, which was otherwise impossible to understand . Great piece of software, still going strong too.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#52

Post by Avicebron »

rapind wrote: post #48
Avicebron wrote: post #44

Earlier quoted context omitted.

The only thing that matters is extensibility/customization and speed. I want the lightest, most customizable thing that isn't emacs (for real reasons, trying to set up emacs at work is too much of pain in the ass) as my single pane of glass on any OS I care to use. If it can't do that, it doesn't live long.

I want the lightest, most customizable thing, that is also Vim. Thank god there's Vim for that. (cloning my dotfiles for instant setup on a new box)

I mean, sure, you could do that. No one said being competent was easy. Have you tried lisp?

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#53

Post by GrayShade »

ryukoposting wrote: post #46
josephg wrote: post #15

Earlier quoted context omitted.

> Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Is eclipse good now? I used it 15 years ago. It took ages to start. It was a memory hog and it was dog slow besides. My entire team got RAM upgrades on our computers because the default company issued machines (which were quite good at the time) didn't have enough RAM to use eclipse properly. I can't imagine why it went out o…

> It took ages to start. It was a memory hog and it was dog slow besides. My entire team got RAM upgrades The more things change, the more they stay the same. I used to use VS Code on some very large C projects with 16GB of RAM, and my machine would grind to a halt while intellisense was indexing.

The indexer was probably clangd, not Code itself.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#55

Post by dangus »

TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

It's the license. The MIT license is what makes VSCode the defacto answer.

It also runs on the web, which makes it extremely convenient to toss into...web things. It's the code editor for the Google Cloud console, the Lambda web console, the GitHub web editor, and so on.

I'm going to guess that Eclipse doesn't have the same amount of security issues because it's not a popular target. Everyone (relatively speaking) is using VSCode or something based on it.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#56

Post by josephg »

jmyeet wrote: post #32

Maybe I'm a dinosaur in this regard but I don't like nor trust any of these desktop application that are really just Web technologies with an embedded browser eg Discord. They're resource hogs and the attack surface is huge. You're basically betting that automatic code that's run won't find a vulnerability and escape the sandbox from an entire browser. I have way more trust in Jetbrains IDEs and the JVM as a sandbox…

Yep. You’d think using web tech would make it really easy to sandbox any 3rd party JavaScript that gets run. But I suppose sandboxing is simply too inconvenient.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#57

Post by glenngillen »

jonwinstanley wrote: post #45
TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

As I remember it, VS code was Microsoft’s response to Sublime. Sublime was exceptionally popular for web developers throughout the 2010s. Sublime was maintained by a single person as far as I know. VS code was pretty much a copy of Sublime but with a much better extensions system and relatively quickly there were some great plugins that made VS code the de-facto editor for web development.

Wasn’t it a copy of Atom?

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#58

Post by Alupis »

josephg wrote: post #50
Alupis wrote: post #22

Earlier quoted context omitted.

How much ram did you have, and when was this? I remember being extremely happy with Eclipse on an 8GB machine - this was back in the jvm7 days. Heck, I did jvm6 development with Eclipse on Windows XP with 4GB of ram and was content. Eclipse gets a lot of automatic hate - I believe mostly since a lot of people first use it in university and struggled with their first real IDE. For years and years I had people telling…

It was 2010. Our default work machines had 16gb of ram. Eclipse ran, but it was tight. Especially while debugging. Some developers also apparently liked to open a second eclipse instance for some reason. You'd go OOM pulling stunts like that. They upgraded all of us to 32gb. 32gb doesn't sound like a lot of ram now, but in 2010 it seemed pretty wild to me. Especially for just running an IDE. In eclipse's defence, we…

That seems incredible. 16GB of ram to run (presumably windows 10) and Eclipse?

Eclipse, unlike IntelliJ offers "project" view were you have have many "solutions" open at once. Even with multiple Eclipse instances open, it's hard to imagine it consuming so much ram.

Perhaps you had other company-required software running. I was working on relatively largeish codebases and very happy with 8GB of ram until 2018ish.

Regardless, an IDE is more than a text editor, so your claim that RustRover with 4.5GB of ram is inefficient is misguided.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#59

Post by fizlebit »

I do feel like better application sandboxing is needed but so much open source software is built on the Unix abstraction meaning you have to run in a container, but macOS doesn’t have containers as far as I can see, and containers themselves are a bit of a poor abstraction, although maybe the best we can do with Unix at the core. I think something closer to Roblox studio would be cool where when you open an environment stuff just spins up in the background, but there is a good debugger, logging, developer ide, good rendering, eg 3d graphics, separate projects are separate, and when you spin down a game (read app or project) everything spins down.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#60

Post by jonwinstanley »

glenngillen wrote: post #57
jonwinstanley wrote: post #45

Earlier quoted context omitted.

As I remember it, VS code was Microsoft’s response to Sublime. Sublime was exceptionally popular for web developers throughout the 2010s. Sublime was maintained by a single person as far as I know. VS code was pretty much a copy of Sublime but with a much better extensions system and relatively quickly there were some great plugins that made VS code the de-facto editor for web development.

Wasn’t it a copy of Atom?

Yes, Atom was an earlier shot at building a Sublime competitor too.

I don’t know how usage of Atom compared to Sublime, but within my friends and colleagues it was only when VS code got good that people started moving away from Sublime.

Post reply on HN