Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub confirms breach of 3,800 repos via malicious VSCode extension

bleepingcomputer.com

Post reply on HN
Print view View original

111–120 of 488 posts

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#111

Post by bbor »

fg137 wrote: post #44

The (lack of) security of VSCode has always been astounding. People have asked for sandboxing extensions for years [0] with little to no progress, and issues have been discussed a lot (e.g. [1][2]). I guess it hasn't been a big issue, likely because most developers are not complete idiots. But it only takes one developer and one bad extension to consequences like this. I mean, I understand that it is hard to sandbox…

I am so, so stressed about Sublime Text... It feels like a massive disaster just waiting to happen. They don't even run their own package marketplace :(

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#112

Post by pamcake »

notnullorvoid wrote: post #45

I really hope this pushes Microsoft to add a explicit permission system to VS Code extensions, and improve security of dev containers.

I really hope this pushes users (here: devs and maintainers) to decrease their reliance on Microsoft and especially stop outsourcing security to them.

Migrate off vscode already.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#113

Post by ryanhecht »

tekacs wrote: post #24

Maybe I'm missing something really obvious, but... 3,800 repos? I guess I find it kind of surprising they have that many!

Something cool that I've always liked about working at GitHub is how much of the company _runs on GitHub_ -- A lot of teams, even non-technical teams, have their own repos just to organize docs/SOP's/designs/etc like a traditional knowledge work company might use a Sharepoint

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#114

Post by unethical_ban »

internet101010 wrote: post #62
duped wrote: post #52

Earlier quoted context omitted.

podman seems to handle rootless namespaces just fine, minor caveat for some perf overhead but it's not the end of the world.

And volumes. Volumes are not fun with podman. Ironically my team tried GitHub Codespaces and never looked back. Super cheap and uses DevContainers.

What's the difference between Podman and docker for volumes? Other than needing to add Z to get volumes to mount with SELinux

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#116

Post by lacker »

psadauskas wrote: post #69

If only the company behind VSCode, the company behind NPM and the company behind GitHub could get together and figure out a solution to this.

Perfectly demonstrating the truth of the "Microsoft org chart" cartoon.

https://bonkersworld.net/organizational-charts

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#117

Post by skissane »

unix4ever wrote: post #65
skissane wrote: post #63

Earlier quoted context omitted.

In my personal experience, give it a decade or two, and any corporation will accumulate hundreds (or even thousands) of abandoned internal repos containing discontinued services, POCs/prototypes that never went anywhere, etc – people forget to archive them, or aren't sure whether something is still in use or not so err on the safe side. AI is making this even worse. With coding agents, anyone can throw together a qui…

Maybe though AI will make it better, assign agents to monitor, maintain and keep repos up to date or via A2A refer them to an agent to dispose of them in accordance with company requirements. I actually think AI will greatly help this type of problem.

Autoarchiving repos which nobody has used in X years doesn’t require any AI - you can just write a bot to do it. People don’t, because it isn’t a priority. AI can make writing such a bot a bit easier, but can’t help much with getting approval from the powers that be to run it.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#120

Post by notnullorvoid »

pamcake wrote: post #112
notnullorvoid wrote: post #45

I really hope this pushes Microsoft to add a explicit permission system to VS Code extensions, and improve security of dev containers.

I really hope this pushes users (here: devs and maintainers) to decrease their reliance on Microsoft and especially stop outsourcing security to them. Migrate off vscode already.

> Migrate off vscode already.

Zed is the closest thing I've found to meet my needs, and I do plan to try it. However it's dev container support looks to be lacking in some important ways so we'll see.

Post reply on HN