171–180 of 488 posts
I was also toying with comparimg timestamps of git tags / GitHub releases / GitHub actions / plugin update timestamps as one indicator of potential tempering.
But not ideal.
The (lack of) security of VSCode has always been astounding. People have asked for sandboxing extensions for years [0] with little to no progress, and issues have been discussed a lot (e.g. [1][2]). I guess it hasn't been a big issue, likely because most developers are not complete idiots. But it only takes one developer and one bad extension to consequences like this. I mean, I understand that it is hard to sandbox…
Don’t attack individuals for mistakes of a system.
Vs code extensions have been terrifying for a long time. Such a wild and obvious attack vector. I'm constantly getting pop ups in vscode to install an extension because it recognizes a certain file type. It's 50-50 whether that extension is owned by a company or some random dev. Some of these have millions of installs and on first glance appear to be official company owned extensions. I'm at a point in my life where…
The problem extends far beyond VS code. All extensions and executable code has the same problem. There was a case where Disney was hacked because an employee installed a BeamNG mod that had bundled malware. A company that wants to remain secure would have to employ strict restrictions on installing software. Only installing npm packages and plugins from an internal preapproved repo for example.
You regularly run tons of untrusted code when visiting websites. That code can't wreak havoc on your machine because it's well-sandboxed. Yet, if we advocate for sandboxing in more places, the "gun nuts of tech" scream about monopolistic practices and taking away user control.
I'm more surprised hackers found a large enough uptime window to do this.
For those not getting the joke, GitHub has had an increasingly difficult keeping itself up since Microsoft acquired them. It's gotten a lot worse (and made news) more recently, as the downtime as increased.
So which extension? Why don't they tell us?
Earlier quoted context omitted.
And volumes. Volumes are not fun with podman. Ironically my team tried GitHub Codespaces and never looked back. Super cheap and uses DevContainers.
What's the difference between Podman and docker for volumes? Other than needing to add Z to get volumes to mount with SELinux
If you're just a user running containers under Podman, it's more tricky.
If only the company behind VSCode, the company behind NPM and the company behind GitHub could get together and figure out a solution to this.
Perfectly demonstrating the truth of the "Microsoft org chart" cartoon. https://bonkersworld.net/organizational-charts
If only the company behind VSCode, the company behind NPM and the company behind GitHub could get together and figure out a solution to this.
Not trolling here but these things are by design cesspools ready for compromise. Any fully open ecosystem where contributions are not strictly reviewed is open to this problem. If you don't like it, don't use editor extensions and use a well audited editor. If you want to use extensions or node packages or pypi packages without doing a detailed review you're accumulating technical debt. You're assuming a risk in orde…
Earlier quoted context omitted.
Not trolling here but these things are by design cesspools ready for compromise. Any fully open ecosystem where contributions are not strictly reviewed is open to this problem. If you don't like it, don't use editor extensions and use a well audited editor. If you want to use extensions or node packages or pypi packages without doing a detailed review you're accumulating technical debt. You're assuming a risk in orde…
Extensions never had to be given unsandboxed access to everything. That's a choice that they actively made.
Earlier quoted context omitted.
I won't say "you can take my VS Code from cold dead hands" or anything, but it is a very good tool, and Microsoft hasn't yet fucked it up the way they have so many other things. I guess I'd say "you take my VS Code ... willingly ... but only after M$ fucks it up and makes me not want it anymore (like they've done to everything else they acquired)".
> Microsoft hasn't yet fucked it up the way they have so many other things. Not for lack of trying, the amount of CoPilot cruft bundled with the core IDE is growing quarterly.
Every updates release notes is like 90% “now with more copilot plz use it.”