Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Threat actors expand abuse of Microsoft Visual Studio Code

jamf.com

Post reply on HN
Print view View original

91–100 of 306 posts

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#91

Post by vanviegen »

rmunn wrote: post #37
godelski wrote: post #28

Earlier quoted context omitted.

Load time is in seconds, even with the program cached. I can still load vim with a ton of plugins[0] and still load a project in a few hundred milliseconds. Maybe VS Code is faster with fewer plugins but it's still "dog slow" to load and run. Only thing I'm "missing" in vim is the bloat [0] personal I only use a handful but I've played around because why not

With LazyVim (requires NeoVim) and its load-on-demand architecture, startup time usually stays below 50 milliseconds even with a ton of plugins. Below 50ms is fast enough that it feels instant . Aliasing `nvim` to `n` in my ~/.bash_aliases just makes it even faster. cd to a project directory, run `n .` and I'm looking at the NeoVim file explorer plugin for that project directory. No break in thought flow, no standing…

Your focus on startup speed feels really alien to me. When working on a project I just keep vscode open. I reboot maybe once a week and starting vscode again takes about a second, and then maybe 10s of seconds of background processing, depending on the project size, for the language server to become fully operational. That's more than good enough for me.

I've done a lot of shell-driven development in the 00s though, and I remember it did involve frequently firing up vim instances for editing just a single file. I no longer understand the appeal of that approach. Navigating between files (using fuzzy search or go-to-definition) is just a lot faster and more convenient.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#92

Post by AmazingTurtle »

"Code provides features that may automatically execute files in this folder. If you don't trust the authors of these files, we recommend to continue in restricted mode as the files may be malicious."

If you proceed with "Trust Project" you're at your own fault.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#93

Post by pjmlp »

TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

VSCode main architect is one of the Eclipse authors, Erich Gamma.

Other than that, it is more fashionable to ship Chrome with applications and JavaScript is hot. /s

Eclipse remains my main Java IDE at work.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#94

Post by pjmlp »

josephg wrote: post #15
TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

> Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Is eclipse good now? I used it 15 years ago. It took ages to start. It was a memory hog and it was dog slow besides. My entire team got RAM upgrades on our computers because the default company issued machines (which were quite good at the time) didn't have enough RAM to use eclipse properly. I can't imagine why it went out o…

Definitely, it has been at least a decade since I had plugins corrupt my workspace, and there are old Reddit comments of me complaining about in on /r/java.

Load VSCode with the same amount of plugins, each requiring its own process, to see how "fast" it runs, not to mention Electron crap, there is a reason so many Microsoft plugins are actually written in C++ and Rust.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#95

Post by pjmlp »

eikenberry wrote: post #6
TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

Seems very odd to me that someplace would force the use of a particular development tool. I've seen it only one time while interviewing, where they wanted everyone to have identical setups so they could easily hop onto each others computers when needed... it was weird and I took it as a red flag and didn't follow through them them.

This is common in many companies, IT wants standard development environments.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#96

Post by perryizgr8 »

AmazingTurtle wrote: post #92

"Code provides features that may automatically execute files in this folder. If you don't trust the authors of these files, we recommend to continue in restricted mode as the files may be malicious." If you proceed with "Trust Project" you're at your own fault.

The "trust project" feature has been designed to be so extremely intrusive and annoying that the first thing I do is to completely disable it whenever I install VS Code on a new computer. This "solution" was just done to tick some box and put the blame on the user when a security incident happens. It's pretty similar to Windows Vista where it annoyed you with a disruptive popup so many times during the normal course of actions that most people ended up disabling the whole UAC system. Overall security goes down, and Microsoft has a nice excuse.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#97

Post by thebruce87m »

AmazingTurtle wrote: post #92

"Code provides features that may automatically execute files in this folder. If you don't trust the authors of these files, we recommend to continue in restricted mode as the files may be malicious." If you proceed with "Trust Project" you're at your own fault.

You know what would be better? Telling me explicitly what file/script will run and asking permission for that. A blanket message every time is no better than the cookie popups and doesn’t tell me if the project has 0 files that will run.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#98

Post by pjmlp »

jonwinstanley wrote: post #45
TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

As I remember it, VS code was Microsoft’s response to Sublime. Sublime was exceptionally popular for web developers throughout the 2010s. Sublime was maintained by a single person as far as I know. VS code was pretty much a copy of Sublime but with a much better extensions system and relatively quickly there were some great plugins that made VS code the de-facto editor for web development.

Nope it started as a Web IDE, going against Atom was their pivot to win market share, there are a few talks from the team if you search for VSCode history.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#99

Post by pjmlp »

jmyeet wrote: post #32

Maybe I'm a dinosaur in this regard but I don't like nor trust any of these desktop application that are really just Web technologies with an embedded browser eg Discord. They're resource hogs and the attack surface is huge. You're basically betting that automatic code that's run won't find a vulnerability and escape the sandbox from an entire browser. I have way more trust in Jetbrains IDEs and the JVM as a sandbox…

Same here, I only use VSCode because in some scenarios I have no choice, from regulated IT environments, or product SDKs with plugins only for it.

When I can avoid it, the better.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#100

Post by aragonite »

GrayShade wrote: post #53
ryukoposting wrote: post #46

Earlier quoted context omitted.

> It took ages to start. It was a memory hog and it was dog slow besides. My entire team got RAM upgrades The more things change, the more they stay the same. I used to use VS Code on some very large C projects with 16GB of RAM, and my machine would grind to a halt while intellisense was indexing.

The indexer was probably clangd, not Code itself.

IME more likely cpptools (which comes with vscode) than clangd.

Relevant: https://news.ycombinator.com/item?id=43788332

Post reply on HN