Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Threat actors expand abuse of Microsoft Visual Studio Code

jamf.com

Post reply on HN
Print view View original

131–140 of 306 posts

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#131

Post by direwolf20 »

andy_ppp wrote: post #129
mjdv wrote: post #121

Earlier quoted context omitted.

Until this post it wasn't clear to me that just opening and trusting a directory can cause code to be run without taking any other explicit actions that seem like they might involve running code, like running tests. My bad, but still!

What is the stated reasoning for arbitrary code execution as a feature? Seems pretty mad to me.

Makefiles etc. Many types of projects use arbitrary setup and build commands or can load arbitrary plugins, and unlike VS which imposes its own project format, VSC tries to be compatible with everything that people already use. Git hooks are another one.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#132

Post by duskdozer »

echoangle wrote: post #113
pmontra wrote: post #108

My first reaction has been: when we install some node modules, import them and eventually run them, we do grant local execution permissions to whatever the authors of those modules coded in their scripts, right? More or less every language already suffer from the same problem. Who vets the code inside a Ruby gem, a Python package, etc? Add your favorite language. However I did not know about tasks.json (I don't use V…

You get asked if you trust the folder you’re opening every single time you open a new folder in VsCode. Everyone probably always just says yes but it’s not like it doesn’t tell you that opening untrusted folders is dangerous.

The message isn't very clear on what exactly is allowed to happen. Just intuitively, I wouldn't have expected simply opening a folder would "automatically execute tasks" because that's strange to me

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#133

Post by willtemperley »

fizlebit wrote: post #59

I do feel like better application sandboxing is needed but so much open source software is built on the Unix abstraction meaning you have to run in a container, but macOS doesn’t have containers as far as I can see, and containers themselves are a bit of a poor abstraction, although maybe the best we can do with Unix at the core. I think something closer to Roblox studio would be cool where when you open an environme…

UTM is free and spins up native macOS VMs. If I absolutely have to write JavaScript that’s where I do it, since Sha1 Hulud.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#134

Post by [deleted] »

mjdv wrote: post #121
echoangle wrote: post #113

Earlier quoted context omitted.

You get asked if you trust the folder you’re opening every single time you open a new folder in VsCode. Everyone probably always just says yes but it’s not like it doesn’t tell you that opening untrusted folders is dangerous.

Until this post it wasn't clear to me that just opening and trusting a directory can cause code to be run without taking any other explicit actions that seem like they might involve running code, like running tests. My bad, but still!

[deleted]

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#135

Post by g947o »

josephg wrote: post #16
reaperducer wrote: post #5

Earlier quoted context omitted.

why is VS code the defacto answer nowaday? 1. It's free 2. A million plug-ins Personally, I don't use it because it's so dog slow.

> A million plug-ins > I don't use it because it's so dog slow. You might find it runs better with fewer plugins.

Or with most language specific extensions disabled by default.

I almost disable all extensions except the ones I use all the time. Then I enable specific ones at workspace level.

Yes, it's annoying. But as an extension author, I know how some badly written extension can significantly slow down the experience, both during startup and editing. I even profiled other people's extensions and submitted feedback.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#136

Post by ahyattdev »

z3t4 wrote: post #80
josephg wrote: post #15

Earlier quoted context omitted.

> Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Is eclipse good now? I used it 15 years ago. It took ages to start. It was a memory hog and it was dog slow besides. My entire team got RAM upgrades on our computers because the default company issued machines (which were quite good at the time) didn't have enough RAM to use eclipse properly. I can't imagine why it went out o…

Todays hard drives are faster then memory was back then, so it's probably not an issue now. Could probably reparse your entire code base at every key stroke without you noticing.

Modern PCIe NVME drives typically see a few microsecond latency, but even DDR2 latency was around 10 nanoseconds. Memory remains top dog by a long shot.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#138

Post by retsl »

solarkraft wrote: post #76
CaRDiaK wrote: post #71

Earlier quoted context omitted.

Apple did actually introduce its own container framework in Tahoe, but it’s still early days. https://github.com/apple/container

These are Linux containers in a VM, I’m pretty sure GP is talking about native macOS containers. Which: They do actually have some container-like sandboxing tech around applications (“iTerm wants to access your downloads folder”).

Yes, afaik macOS apps could theoretically be sandboxed as well (or close to) as iOS apps are. You can find the policies for many first-party apps and deamons in /System/Library/Sandbox/Profiles. But in practice most third-party apps aren't.

https://bdash.net.nz/posts/tcc-and-the-platform-sandbox-poli... and https://bdash.net.nz/posts/sandboxing-on-macos/ are good introductory articles.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#139

Post by echoangle »

duskdozer wrote: post #132
echoangle wrote: post #113

Earlier quoted context omitted.

You get asked if you trust the folder you’re opening every single time you open a new folder in VsCode. Everyone probably always just says yes but it’s not like it doesn’t tell you that opening untrusted folders is dangerous.

The message isn't very clear on what exactly is allowed to happen. Just intuitively, I wouldn't have expected simply opening a folder would "automatically execute tasks" because that's strange to me

https://code.visualstudio.com/docs/editing/workspaces/worksp...

It is very clear, the first sentence it that it may automatically execute code.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#140

Post by nottorp »

EE84M3i wrote: post #8
dfajgljsldkjag wrote: post #7

It is scary that a text editor can run hidden code just by opening a folder. We traded our safety for convenience and now we are paying the price. Users will always click the button to trust a file if they think it helps them work faster. We cannot blame them when the software design makes it so easy to make a mistake.

Doesn't it ask you if you trust a folder when you open it?

I always wondered why. Now I finally know that it auto runs code in that folder.

Who thought this is a good idea and why wasn't it specified in ALL CAPS in that dialog?

Is it even documented anywhere?

Very infrequent vscode user here, beginning to think it's some kind of Eclipse.

Post reply on HN