Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Threat actors expand abuse of Microsoft Visual Studio Code

jamf.com

Post reply on HN
Print view View original

71–80 of 306 posts

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#71

Post by CaRDiaK »

fizlebit wrote: post #59

I do feel like better application sandboxing is needed but so much open source software is built on the Unix abstraction meaning you have to run in a container, but macOS doesn’t have containers as far as I can see, and containers themselves are a bit of a poor abstraction, although maybe the best we can do with Unix at the core. I think something closer to Roblox studio would be cool where when you open an environme…

Apple did actually introduce its own container framework in Tahoe, but it’s still early days. https://github.com/apple/container

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#72

Post by m-schuetz »

com2kid wrote: post #31
TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

I switched to VSCode because it has a free editor with a really great jump to file hotkey. I remember when the big VS added jump to file but it was so damn miserably implemented as to be useless. Having worked at Microsoft for a decade, the most frequent way I navigated a large source tree was dir /s *partialfilename*.* Then again while I was there, most code bases couldn't even open in Visual Studio. (highly team de…

Same here! Easily jumping between files is one of the best features. I always have VS and vscode open simultaneously, doing about 99% of the work in vscode and only using VS to compile and to debug.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#73

Post by jmyeet »

winterqt wrote: post #68
jmyeet wrote: post #32

Maybe I'm a dinosaur in this regard but I don't like nor trust any of these desktop application that are really just Web technologies with an embedded browser eg Discord. They're resource hogs and the attack surface is huge. You're basically betting that automatic code that's run won't find a vulnerability and escape the sandbox from an entire browser. I have way more trust in Jetbrains IDEs and the JVM as a sandbox…

Won’t IDEA automatically index/execute some Gradle code when possible? As soon as you execute an arbitrary binary/script from the project directory, the isolation of the JVM doesn’t matter.

This particular vulnerability relied upon passing the require function to a scope to allow the loading and running of arbitrary code. This is what I tend to call a blacklist approach. You're saying in this sandbox certain features can't be used because they will allow escape.

The alternative is a whitelist approach. Instead of disallowing dangerous features you're enabling only the features you need.

So a build system like Gradle or Maven (same thing really) has a limited set of primitives it is allowing access to. It's not loading, say, the entire JVM and all the Java core libraries and then listing all those you can't use.

You see the difference? If nothing else, the blacklist approach is going to fail when the virtual machine (or whatever) adds a new API call upstream and it's added without intent to the sandbox by simply doing an update where nobody has thought to disable it.

Another way of looking at this is Gradle isn't being compiled into Java bytecode and run in the same environment as the IDE (sandboxed or otherwise). That is inherently riskier.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#74

Post by fleebee »

jonwinstanley wrote: post #60
glenngillen wrote: post #57

Earlier quoted context omitted.

Wasn’t it a copy of Atom?

Yes, Atom was an earlier shot at building a Sublime competitor too. I don’t know how usage of Atom compared to Sublime, but within my friends and colleagues it was only when VS code got good that people started moving away from Sublime.

I can only speak for $MY_JOB, but I'm pretty sure everyone was on Atom before VSC "got good". Atom had a good plugin ecosystem; what really drove the change was Atom's horrible performance issues whereas VSC was snappy and responsive.

What I believe also influenced the shift was that at that point in time MS had accumulated a decent amount of developer trust by giving us TypeScript and later on by acquiring GitHub. They appeared to care and have the right vision for open source.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#75

Post by itemize123 »

fizlebit wrote: post #59

I do feel like better application sandboxing is needed but so much open source software is built on the Unix abstraction meaning you have to run in a container, but macOS doesn’t have containers as far as I can see, and containers themselves are a bit of a poor abstraction, although maybe the best we can do with Unix at the core. I think something closer to Roblox studio would be cool where when you open an environme…

apple has pretty good containers actually. why do you say they are a poor abstraction?

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#76

Post by solarkraft »

CaRDiaK wrote: post #71
fizlebit wrote: post #59

I do feel like better application sandboxing is needed but so much open source software is built on the Unix abstraction meaning you have to run in a container, but macOS doesn’t have containers as far as I can see, and containers themselves are a bit of a poor abstraction, although maybe the best we can do with Unix at the core. I think something closer to Roblox studio would be cool where when you open an environme…

Apple did actually introduce its own container framework in Tahoe, but it’s still early days. https://github.com/apple/container

These are Linux containers in a VM, I’m pretty sure GP is talking about native macOS containers.

Which: They do actually have some container-like sandboxing tech around applications (“iTerm wants to access your downloads folder”).

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#77

Post by sakjur »

closeparen wrote: post #62
TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

Never liked Eclipse, but I’ve been forced to use VSCode over my preferred JetBrains IDEs because it is the only modern mainstream editor with a competent client-server mode. As in, actually rendering the UI locally while doing all the code indexing and intelligence on the server. Corporate world would much rather maintain disposable remote VMs than help you unfuck your laptop after whatever required security upgrade…

Have you tried Jetbrains Gateway? I’m curious whether it’s insufficient or just too recent, as I’ve eyed it a few times.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#78

Post by mrkeen »

TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

It just happens. I was happy on netbeans, then I was forced over to eclipse, which I got used to. Then I got forced over to intellij. I'm still pissed about that (even though it's rider for me these days).

I don't mind VSCodium that much because I can put my tooling on the side (like a good unix fanboy) instead of hoping that jetbrains reimplements every other tool. Ag, grep beat IDE searches any day.

But yeah we have reach a stupid point in the industry where VSCodium asks me to trust a codebase before it will let me edit it.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#79

Post by mrkeen »

closeparen wrote: post #62
TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

Never liked Eclipse, but I’ve been forced to use VSCode over my preferred JetBrains IDEs because it is the only modern mainstream editor with a competent client-server mode. As in, actually rendering the UI locally while doing all the code indexing and intelligence on the server. Corporate world would much rather maintain disposable remote VMs than help you unfuck your laptop after whatever required security upgrade…

Yikes, sounds like hell.

Corporate never seems to get that git is the kind of interface you want between your computer and their servers.

Then when you trash your computer you can just get it back to the state of being able to git.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#80

Post by z3t4 »

josephg wrote: post #15
TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

> Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Is eclipse good now? I used it 15 years ago. It took ages to start. It was a memory hog and it was dog slow besides. My entire team got RAM upgrades on our computers because the default company issued machines (which were quite good at the time) didn't have enough RAM to use eclipse properly. I can't imagine why it went out o…

Todays hard drives are faster then memory was back then, so it's probably not an issue now. Could probably reparse your entire code base at every key stroke without you noticing.
Post reply on HN