Where's the torrent
GitHub confirms breach of 3,800 repos via malicious VSCode extension
211–220 of 488 posts
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#212Earlier quoted context omitted.
The problem extends far beyond VS code. All extensions and executable code has the same problem. There was a case where Disney was hacked because an employee installed a BeamNG mod that had bundled malware. A company that wants to remain secure would have to employ strict restrictions on installing software. Only installing npm packages and plugins from an internal preapproved repo for example.
I don’t understand why we don’t just sandbox everything. We have done it for web browsers, we can definitely do it for VSCode extensions.
Because it's hard to create a system that is both sandboxed and powerful. You can't have an extension system that allows a plugin to run a locally installed linter or view the status of docker containers but can't execute something malicious.
I do agree though that it is incredibly important to start taking sandboxing seriously. But there is a lot of difficulty and friction, and most of the users will scream and cry about extensions being limited.
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#213If only the company behind VSCode, the company behind NPM and the company behind GitHub could get together and figure out a solution to this.
Well, it certainly wasn't for lack of warning about the glaring risks... https://github.com/microsoft/vscode/issues/52116
That is a very well written proposal, I wish someone wrote that sort of ticket for my software projects
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#214Earlier quoted context omitted.
Extensions never had to be given unsandboxed access to everything. That's a choice that they actively made.
I mean I don't think some sort of "access control" within the editor is going to really address this. People edit sensitive text in their code editor and no matter what that is going to be available to most useful extensions. Even if you don't lose a credential or get some arbitrary script running to mine crypto on your machine you could have an extension function as a key logger and exfil code you really think is va…
It would have restrained the access here. The extension would have only had access to the repos opened by this individual rather than an api key that gave access to 3,800 repos.
They probably should have some permission system where the default extension is only able to operate within the repos open at the time and has no internet access. Then you can grant internet access for the ones which genuinely need it.
The majority of VS code plugins are just syntax highlighers and linters which don't need any dangerous permissions.
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#215If only the company behind VSCode, the company behind NPM and the company behind GitHub could get together and figure out a solution to this.
Perfectly demonstrating the truth of the "Microsoft org chart" cartoon. https://bonkersworld.net/organizational-charts
This is 2011 though, a lot has changed since then. I doubt Facebook/Meta, for instance, is still as flat as it was then having read some ex-employee accounts
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#216Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#217Earlier quoted context omitted.
Fully agree with the first half of your comment. The second half goes off the rails, though. I rarely see people complain about sandboxing. What people complain about is when devices are locked down in a way where you are only allowed to install software that is approved by a central gatekeeper, even though sandboxing is in place that should make it far safer to run arbitrary safer than on traditional desktop systems…
Agreed. What's frustrating is that we have models for how sandboxing can work and instead of investing efforts into nailing that experience, the OS providers are prone to turning it into a monetization/lock in layer instead. My VLC and VS Code should have an OS native way of being limited to particular functionality. But when the OS providers implement the sandbox, they center it around an App Store and restrictions…
That exists on linux under flatpak, but it requires Wayland and Pipewire. Also many packages just request full system permissions rather than update to work in a sandbox.
It's in the works and one day we will have it but progress is slow.
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#218Earlier quoted context omitted.
I really hope this pushes users (here: devs and maintainers) to decrease their reliance on Microsoft and especially stop outsourcing security to them. Migrate off vscode already.
> Migrate off vscode already. Zed is the closest thing I've found to meet my needs, and I do plan to try it. However it's dev container support looks to be lacking in some important ways so we'll see.
Zed is even worse about arbitrarily downloading random stuff from random websites and executing it
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#219Earlier quoted context omitted.
Extensions never had to be given unsandboxed access to everything. That's a choice that they actively made.
I mean I don't think some sort of "access control" within the editor is going to really address this. People edit sensitive text in their code editor and no matter what that is going to be available to most useful extensions. Even if you don't lose a credential or get some arbitrary script running to mine crypto on your machine you could have an extension function as a key logger and exfil code you really think is va…
Most of these problems could be solved with something like wasm/wasi where you can limit access to web, disk, etc... WASI is made to run code you don't trust, you could even limit compute third party is using so they can't mine crypto (I think it's called fuel limit). Ideally we would have whole IDE run in this kind of environment where we can explicitly say what it can and can't do.
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#220Earlier quoted context omitted.
The problem extends far beyond VS code. All extensions and executable code has the same problem. There was a case where Disney was hacked because an employee installed a BeamNG mod that had bundled malware. A company that wants to remain secure would have to employ strict restrictions on installing software. Only installing npm packages and plugins from an internal preapproved repo for example.
Running code isn't the problem. The fact that (almost) all code runs at the same security level is. You regularly run tons of untrusted code when visiting websites. That code can't wreak havoc on your machine because it's well-sandboxed. Yet, if we advocate for sandboxing in more places, the "gun nuts of tech" scream about monopolistic practices and taking away user control.
Never let a crisis go to waste, huh?
We've had the solution to shit like this, and it's called the SecurityManager in Java. No one wants to configure the damn thing, but it is there. Also, auditing the code you pull in. Yeah. Reading code sucks. Yeah. It's a lotta work. But if you don't check, you don't effing know.
All y'all want the fun of unprotected sex (rawdogging the ecosystem) and are starting to get burned by the VD's we old-timers have been hollerin' at you telling you will be coming the more you do this promiscuous dependency inclusion.
But hey. Enjoy it I guess. No skin off my nose.