61–70 of 488 posts
Isn't 50k a bargain for what could potentially be in those files? Maybe they looked it up and there wasn't anything interesting but then why take the risk for this kind of money? Something doesn't make sense.
It is a blind auction with a $50k minimum bid.
Note that VS Code is built on Electron and it is a pain to sandbox because Electron has (had?) SUID sandbox helper, and you cannot run SUID binaries in sandbox easily. Sandboxing on Linux is extremely difficult task.
podman seems to handle rootless namespaces just fine, minor caveat for some perf overhead but it's not the end of the world.
Maybe I'm missing something really obvious, but... 3,800 repos? I guess I find it kind of surprising they have that many!
AI is making this even worse. With coding agents, anyone can throw together a quick internal prototype of any idea they have, even if it has no hope of ever making it to production.
But, it did not go down! Progress!
Maybe I'm missing something really obvious, but... 3,800 repos? I guess I find it kind of surprising they have that many!
In my personal experience, give it a decade or two, and any corporation will accumulate hundreds (or even thousands) of abandoned internal repos containing discontinued services, POCs/prototypes that never went anywhere, etc – people forget to archive them, or aren't sure whether something is still in use or not so err on the safe side. AI is making this even worse. With coding agents, anyone can throw together a qui…
I really hope this pushes Microsoft to add a explicit permission system to VS Code extensions, and improve security of dev containers.
Not holding my breath. This issue has been open since 2018 https://github.com/microsoft/vscode/issues/52116
Earlier quoted context omitted.
The security measure that the developer didn't use was completely refusing to use vscode. vscode has no security model. It's not like swiss cheese where there are holes and some of the go all the way through. vscode is all hole with some cheese on the side. There is absolutely no isolation between the front-end process, the backend size (the thing that runs in the remote or the devcontainer), and any extensions or an…
Or you can just refuse to use random extensions. I built my own extensions if I needed them. You're a programmer, right? The whole point of extensibility is that you, or your company, can program what you need from your IDE, without having to make a whole IDE from scratch. I have since moved on to making my own IDE, mostly because I hate Electron and its >1gb memory footprint, but vscode served me so much better than…
This is my position as well, but it's rarely received well. Usually, a response like "why would I rewrite something that's already been written and available?" By writing the code, I know how it works. I know it is not infected with crap. I know it will not in the future be infected with crap from a down stream dependency. It seems to me this really took off with node to the point that it's laughable at what people will include with no thought at all. I know component libraries have existed for many other languages before, but node just stands out to me
Earlier quoted context omitted.
> If companies continue to not pay the ransom then we're going to get a lot more things published Paying the ransom means your data still gets leaked and now you're out of money and embarrassed. Why would they ever, ever, delete the data?
If paying the ransom doesn't stop your data getting leaked, nobody will pay the ransom. There is a rational basis for the ransomers to follow through with the deletion. Even the mob did provide "protection" when they coerced you into paying for it.