181–190 of 488 posts
Earlier quoted context omitted.
Uber had 8000 repos at one point with 2000 engineers - https://highscalability.com/lessons-learned-from-scaling-ube...
Probably most of them are forks of some public repo with some patch applied and half of those are probably not even used internally anymore.
And it was each team owning multiple internal repos of their own deployments/libraries, and not, primarily, clones of public repos.
That's one way to make things open source.
Earlier quoted context omitted.
Everything Microsoft makes sucks. If they decided to make vacuum cleaners though, they wouldn’t suck, they would blow.
Just five years ago this opinion was heresy on HN. Those of us who still remembered their behavior in the 80s/90s were belittled. "They have changed, gramps. This really smart Satya Nadella is CEO. They are the good guys now. Don't be so bitter over old stuff like systematic use of illegal tactics to attempt to kill all of its competitors including Linux." Also: Note that the headline undersells the news dramatically…
Vs code extensions have been terrifying for a long time. Such a wild and obvious attack vector. I'm constantly getting pop ups in vscode to install an extension because it recognizes a certain file type. It's 50-50 whether that extension is owned by a company or some random dev. Some of these have millions of installs and on first glance appear to be official company owned extensions. I'm at a point in my life where…
Earlier quoted context omitted.
It is also company behind NuGet. Guess what they did a year ago. They removed 700 or so packages from NuGet proactively but those turned out to be false positives. It is hard to do the right things.
It is hard for Microsoft to do the right things* FTFY
Vs code extensions have been terrifying for a long time. Such a wild and obvious attack vector. I'm constantly getting pop ups in vscode to install an extension because it recognizes a certain file type. It's 50-50 whether that extension is owned by a company or some random dev. Some of these have millions of installs and on first glance appear to be official company owned extensions. I'm at a point in my life where…
Earlier quoted context omitted.
Just five years ago this opinion was heresy on HN. Those of us who still remembered their behavior in the 80s/90s were belittled. "They have changed, gramps. This really smart Satya Nadella is CEO. They are the good guys now. Don't be so bitter over old stuff like systematic use of illegal tactics to attempt to kill all of its competitors including Linux." Also: Note that the headline undersells the news dramatically…
Pretty sure that was astroturfing.
a) Waggener Edstrom (now: WE Communications) or similar
b) Microsoft employees
c) Third-party Microsoft-only developers/IT people (with an obvious vested financial interest)
When installing IntelliJ IDEA extensions, I download the code and try to check it for malicious stuff using Claude Code... But not perfect since the code might not match what was released. We would need reproducible builds... I was also toying with comparimg timestamps of git tags / GitHub releases / GitHub actions / plugin update timestamps as one indicator of potential tempering. But not ideal.
So which extension? Why don't they tell us?
There are rumours that was NX Console VS code extension https://github.com/nrwl/nx-console/security/advisories/GHSA-... https://www.stepsecurity.io/blog/nx-console-vs-code-extensio...