Live data from Hacker News

GitHub confirms breach of 3,800 repos via malicious VSCode extension

bleepingcomputer.com

31–40 of 488 posts

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#31

Note that VS Code is built on Electron and it is a pain to sandbox because Electron has (had?) SUID sandbox helper, and you cannot run SUID binaries in sandbox easily. Sandboxing on Linux is extremely difficult task.

It feels so bad to see the "You need go give Chrome SUID Root for the sandbox to work". Setting a Web Browser SUID Root was an old joke about clueless users. It was the worst security screwup someone could imagine.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#35
post #24

Maybe I'm missing something really obvious, but... 3,800 repos? I guess I find it kind of surprising they have that many!

really? I mean these are internal repos. Probably most of them are random one-off experiments or a place to park code. Google has 2,900 "public" repos on github. Microsoft has ~8k "public" on github too. Can't even imagine how many they have on their internal systems.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#38
post #24

Maybe I'm missing something really obvious, but... 3,800 repos? I guess I find it kind of surprising they have that many!

Personally I have over a hundred, especially from quick prototypes, studies or instances of templates so I can easily see how over 18 years and many hundreds of employees you end up with thousands.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#39
post #30

Isn't 50k a bargain for what could potentially be in those files? Maybe they looked it up and there wasn't anything interesting but then why take the risk for this kind of money? Something doesn't make sense.

The data has been stolen by a criminal group. Paying for "restoring" the data does not guarantee they will delete all copies. There is no way of proving they actually did and they have in fact very little incentive to actually delete it. You have to take their words for it but how can you trust crooks?

> You have to take their words for it but how can you trust crooks?

Because these are repeat actors. If they take a ransom and then re-sell it, no company will pay them ever again.

Don't think of experienced criminal enterprises as "groups of irrational scoundrels." They are companies, with employees, who understand game theory.

Post reply on HN