91–100 of 488 posts
If only the company behind VSCode, the company behind NPM and the company behind GitHub could get together and figure out a solution to this.
Guess what they did a year ago.
They removed 700 or so packages from NuGet proactively but those turned out to be false positives.
It is hard to do the right things.
Isn't 50k a bargain for what could potentially be in those files? Maybe they looked it up and there wasn't anything interesting but then why take the risk for this kind of money? Something doesn't make sense.
> this is not a ransom … Send your offers … we are not interested in under 50k… It is a blind auction with a $50k minimum bid.
The (lack of) security of VSCode has always been astounding. People have asked for sandboxing extensions for years [0] with little to no progress, and issues have been discussed a lot (e.g. [1][2]). I guess it hasn't been a big issue, likely because most developers are not complete idiots. But it only takes one developer and one bad extension to consequences like this. I mean, I understand that it is hard to sandbox…
Just don’t install crap maybe.
Note that VS Code is built on Electron and it is a pain to sandbox because Electron has (had?) SUID sandbox helper, and you cannot run SUID binaries in sandbox easily. Sandboxing on Linux is extremely difficult task.
Earlier quoted context omitted.
As others have said it's just a fraction. I'm in a medium size tech-related company and we have 7500+ in one Github org. We have two orgs, so altogether easily 10K+. Of course most of it is stale, obsolete, sandbox, personal tools, etc. I wouldn't be surprised if Github would have 100K+ internal repos or even more.
no pruning of repos?
The (lack of) security of VSCode has always been astounding. People have asked for sandboxing extensions for years [0] with little to no progress, and issues have been discussed a lot (e.g. [1][2]). I guess it hasn't been a big issue, likely because most developers are not complete idiots. But it only takes one developer and one bad extension to consequences like this. I mean, I understand that it is hard to sandbox…
Why would you sandbox extension? Just don’t install crap maybe.