Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Threat actors expand abuse of Microsoft Visual Studio Code

jamf.com

Post reply on HN
Print view View original

121–130 of 306 posts

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#121

Post by mjdv »

echoangle wrote: post #113
pmontra wrote: post #108

My first reaction has been: when we install some node modules, import them and eventually run them, we do grant local execution permissions to whatever the authors of those modules coded in their scripts, right? More or less every language already suffer from the same problem. Who vets the code inside a Ruby gem, a Python package, etc? Add your favorite language. However I did not know about tasks.json (I don't use V…

You get asked if you trust the folder you’re opening every single time you open a new folder in VsCode. Everyone probably always just says yes but it’s not like it doesn’t tell you that opening untrusted folders is dangerous.

Until this post it wasn't clear to me that just opening and trusting a directory can cause code to be run without taking any other explicit actions that seem like they might involve running code, like running tests. My bad, but still!

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#122

Post by tannhaeuser »

TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

> Im guessing the answer is probably Java is why eclipse is out of favor.

Dude, Eclipse has been out of favor for well over ten years now due to Jetbrains IDEs (IntelliJ IDEA).

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#123

Post by simoncion »

TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

I loved Eclipse. I still like it quite a lot.

I stopped using it because none of the plugins for the languages I was using at the time (Ruby, Python, Erlang) were either worth a damn, or getting updated to track new language features.

I started using VSCode because IntelliJ-family IDEs will report incomplete search results as complete when they are rebuilding their search indices. To put it another way, they will tell you that a string that definitely appears in the project does not appear, if they haven't gotten around to re-adding the files that contain that string to the search index.

This to me is intolerable behavior. Others find it perfectly acceptable.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#124

Post by dragonwriter »

Alupis wrote: post #58
josephg wrote: post #50

Earlier quoted context omitted.

It was 2010. Our default work machines had 16gb of ram. Eclipse ran, but it was tight. Especially while debugging. Some developers also apparently liked to open a second eclipse instance for some reason. You'd go OOM pulling stunts like that. They upgraded all of us to 32gb. 32gb doesn't sound like a lot of ram now, but in 2010 it seemed pretty wild to me. Especially for just running an IDE. In eclipse's defence, we…

That seems incredible. 16GB of ram to run (presumably windows 10) and Eclipse? Eclipse, unlike IntelliJ offers "project" view were you have have many "solutions" open at once. Even with multiple Eclipse instances open, it's hard to imagine it consuming so much ram. Perhaps you had other company-required software running. I was working on relatively largeish codebases and very happy with 8GB of ram until 2018ish. Rega…

> That seems incredible. 16GB of ram to run (presumably windows 10) and Eclipse?

In 2010 it couldn't have been anything later than Win 7; Win 8 was released in 2012.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#126

Post by dragonwriter »

Alupis wrote: post #22
josephg wrote: post #15

Earlier quoted context omitted.

> Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Is eclipse good now? I used it 15 years ago. It took ages to start. It was a memory hog and it was dog slow besides. My entire team got RAM upgrades on our computers because the default company issued machines (which were quite good at the time) didn't have enough RAM to use eclipse properly. I can't imagine why it went out o…

How much ram did you have, and when was this? I remember being extremely happy with Eclipse on an 8GB machine - this was back in the jvm7 days. Heck, I did jvm6 development with Eclipse on Windows XP with 4GB of ram and was content. Eclipse gets a lot of automatic hate - I believe mostly since a lot of people first use it in university and struggled with their first real IDE. For years and years I had people telling…

> Eclipse gets a lot of automatic hate - I believe mostly since a lot of people first use it in university and struggled with their first real IDE.

My first IDE was Turbo Pascal 2.0, about 20 years before I used Eclipse, and I used a lot in between (and since). Eclipse was the single most unintuitive, user hostile, clunky, slow, and painful system to use. A few of those problems probably would have been a little bit less noticeable on a ridiculously high-end machine, but not all of them, and other contemporary IDEs worked well-enough on lighter machines. And despite how much I disliked using Eclipse, I liked the idea of Eclipse, and kept it around because it was, for a while, occupying the niche of “extensible open source platform most popular to target for interesting dev tools” (because there weren't really any alternatives that were as open and extensible).

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#127

Post by zombot »

TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

If you did webshit in eclipse, especially with NPM involved, it would be just as bad. Running arbitrary code from a downloaded bundle seems normal in that world.

> Im guessing the answer is probably Java is why eclipse is out of favor.

I don't get the connection, but Java had log4j, i.e. a remote code execution vulnerability.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#128

Post by StingyJelly »

jhancock wrote: post #105

In VS Code settings search for "tasks" you will find "Task: Allow Automatic Tasks"...turn it off. Anything else that should be locked down?

This may only provide a flalse sense of security. Afaik, there is no way to disable workspace settings taking priority over user settings, so a malious repo can easily override them and reenable automatic tasks.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#129

Post by andy_ppp »

mjdv wrote: post #121
echoangle wrote: post #113

Earlier quoted context omitted.

You get asked if you trust the folder you’re opening every single time you open a new folder in VsCode. Everyone probably always just says yes but it’s not like it doesn’t tell you that opening untrusted folders is dangerous.

Until this post it wasn't clear to me that just opening and trusting a directory can cause code to be run without taking any other explicit actions that seem like they might involve running code, like running tests. My bad, but still!

What is the stated reasoning for arbitrary code execution as a feature? Seems pretty mad to me.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#130

Post by DrBazza »

TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

> Why is VS code the defacto answer nowadays?

For what I do, there's no reasonable alternative at the moment.

I'm sure someone will correct me, but it's the only editor that correctly (for some definition of correct) allows remote editing and devcontainers:

[desktop OS] -> ssh -> [dest box]

[desktop OS] -> [devcontainer]

[desktop OS] -> ssh -> [dest box] -> [devcontainer]

[desktop OS] -> ssh (jumphost) -> [dest box] -> [devcontainer]

I won't name and shame other editors (or IDEs), but either they simply can't do that, or their performance is absolutely, shockingly, abysmal.

Post reply on HN