Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub confirms breach of 3,800 repos via malicious VSCode extension

bleepingcomputer.com

Post reply on HN
Print view View original

281–290 of 488 posts

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#281

Post by hnlmorg »

salawat wrote: post #220
miki123211 wrote: post #173

Earlier quoted context omitted.

Running code isn't the problem. The fact that (almost) all code runs at the same security level is. You regularly run tons of untrusted code when visiting websites. That code can't wreak havoc on your machine because it's well-sandboxed. Yet, if we advocate for sandboxing in more places, the "gun nuts of tech" scream about monopolistic practices and taking away user control.

Never let a crisis go to waste, huh? We've had the solution to shit like this, and it's called the SecurityManager in Java. No one wants to configure the damn thing, but it is there. Also, auditing the code you pull in . Yeah. Reading code sucks. Yeah. It's a lotta work. But if you don't check, you don't effing know. All y'all want the fun of unprotected sex (rawdogging the ecosystem) and are starting to get burned b…

> Also, auditing the code you pull in. Yeah. Reading code sucks. Yeah. It's a lotta work. But if you don't check, you don't effing know.

While I do generally agree with this sentiment, it’s not always possible in the ways you imply:

- Plenty of systems pull packages that are not human readable. For example WASM plugins. Or it might even by in unfamiliar languages such as a Python package calling C.

- You might argue that “if you cannot understand the code then don’t use the package” but that isn’t always practical. Security packages will include maths that is beyond the average software engineer. Other performance-critical packages (such as libraries in the ML space) will have highly optimised code that isn’t easy for the average developer to read through.

- Some supply chain attacks have been targeting popular packages. So now you need to re-read every single point version (!!!) on every update. Heck, even using lock files to the patch version in semver might not save you for some language ecosystems because you can overwrite git tags. So a package version that is safe on your local machine might end up compromised when compiled via CI/CD.

- And then there’s CI/CD itself. We are seeing supply chain attacks in GitHub Actions plugins. So now you have to pin all of your actions to their SHA instead of semver.

There definitely needs to be a better security model to support developers because the current status quo makes it very hard to vet everything you run, and very easy to fuck up. In all other fields of IT, we’d say that was a failure of the process rather than a failure of the individual.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#282

Post by no-name-here »

cwnyth wrote: post #184
mcoliver wrote: post #110

Vs code extensions have been terrifying for a long time. Such a wild and obvious attack vector. I'm constantly getting pop ups in vscode to install an extension because it recognizes a certain file type. It's 50-50 whether that extension is owned by a company or some random dev. Some of these have millions of installs and on first glance appear to be official company owned extensions. I'm at a point in my life where…

I've stayed with Sublime, often to the derision of VSCode addicts. I love to see the "VSCode is perfect" uncritical thinkers get theirs.

Sublime also has packages. https://packagecontrol.io

Sublime's de facto package control repository is handled by an Uber engineer and father of 5 in his spare time, not someone currently at Sublime per https://packagecontrol.io/about / https://packagecontrol.io/say_thanks and his linked site.

VS Code Marketplace seems to have a number of protections in place: https://code.visualstudio.com/docs/configure/extensions/exte... / https://code.visualstudio.com/api/advanced-topics/extension-...

It also appears that Sublime doesn't have sandboxing: https://github.com/sublimehq/sublime_text/issues/6915

> I love to see …

Be kind to others. https://news.ycombinator.com/newsguidelines.html

> "VSCode is perfect"

Is the claim "VSCode is perfect" one that you've regularly run across, that you specifically called it out?

(I'm personally happy that multiple editor options exist.)

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#283

Post by Sander_Marechal »

a_t48 wrote: post #130
sbarre wrote: post #84

Earlier quoted context omitted.

No OP but I used to work at a large company with a similar number of repos. When I left about a year ago, we had just started (after being on Github for almost 8 years) an ongoing project of first archiving old/outdated repos in place, and then moving them to an "archived" sub-org, and waiting to see if anyone complained. Previously no one wanted to outright delete or remove repos because of the risk that someone som…

This is a continual fight for me. At nearly every company I've had to compromise on using a graveyard repo for packages within a monorepo, even though git has the whole history already.

The problem with history is that you need to know when to look. If you're looking for some old code that you know existed but you don't know exactly what it was, you can't just browse to go and find it.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#284

Post by swiftcoder »

miki123211 wrote: post #173
Gigachad wrote: post #138

Earlier quoted context omitted.

The problem extends far beyond VS code. All extensions and executable code has the same problem. There was a case where Disney was hacked because an employee installed a BeamNG mod that had bundled malware. A company that wants to remain secure would have to employ strict restrictions on installing software. Only installing npm packages and plugins from an internal preapproved repo for example.

Running code isn't the problem. The fact that (almost) all code runs at the same security level is. You regularly run tons of untrusted code when visiting websites. That code can't wreak havoc on your machine because it's well-sandboxed. Yet, if we advocate for sandboxing in more places, the "gun nuts of tech" scream about monopolistic practices and taking away user control.

> Yet, if we advocate for sandboxing in more places

Sandboxing plugins is pretty much universally desired? You seem to be conflating this with the issue of platform gatekeepers deciding which software is allowed to run on our own hardware

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#285

Post by moring »

Gigachad wrote: post #273
moring wrote: post #250

Earlier quoted context omitted.

> You can't have an extension system that (...) Yes you can. Extension systems of today have multiple problems that prevent that. The basic assumption that has to go, though, is that a core application like VSCode can be written once, then be extended to infinity without the core evolving . That's an assumption you see everywhere in extension systems, and it restricts everything to "features or security, but not both…

These kinds of permissions lists have been mostly a failure in history. Users see a massive list of permissions, or permissions constantly changing between updates and just ignore them because there’s no way to reasonably audit them or take any action on them. Securing VS code would require making malware that has access to the system impossible, not just making it add a permission to the permission list.

Ideally, the permission list is meant for curators which end-users trust and can rely on.

Also, historically, permission lists have been fine-grained but too coarse at the same time, meaning they were "fine" in the wrong way, based on what is easy to implement instead of what the user needs.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#286

Post by moring »

vlovich123 wrote: post #254
moring wrote: post #250

Earlier quoted context omitted.

> You can't have an extension system that (...) Yes you can. Extension systems of today have multiple problems that prevent that. The basic assumption that has to go, though, is that a core application like VSCode can be written once, then be extended to infinity without the core evolving . That's an assumption you see everywhere in extension systems, and it restricts everything to "features or security, but not both…

I don’t know what linters you use, but the ones I like are the ones that show you problems in the workspace stably, not just in the files that happen to be open and altering as files open and close. You can always improve, but pretending like there’s an easy solution is lazy - if it was easy it would have been done.

This was bad wording on my part. I wrote "open" but that should have been "files in the workspace/project". Really, "open" WRT files is so overloaded already, they can be in the workspace, have an editor tab open for them, or have an active file handle, to name just three.

> You can always improve, but pretending like there’s an easy solution is lazy - if it was easy it would have been done.

I claimed that it is possible, not that it is easy.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#287

Post by jay_kyburz »

giancarlostoro wrote: post #279
Balinares wrote: post #277

Earlier quoted context omitted.

Wait, how do you arrive at the thought that Zed is more secure? The one time I gave it a try, it tried to silently run npm -- yes, THIS[1] npm -- in the background without telling me, and I noped the heck out. Did I miss something? [1] https://www.reddit.com/r/programming/comments/1tapmvi/mass_n...

Pretty sure any IDE worth anything that has JS support pulls NPM packages at some point to lint code, no? You're not giving me much to be outraged about without more information. Zed tries to set things up for you so you're not wasting hours trying to figure out how to set them up in a brand new editor.

No doubt an unpopular opinion, but if I install an app that is going to do things in the background, I'm going to hold that apps developers responsible for any breaches. If Zed needs javascript to do its job, it probably should be downloading it from their own servers, or even better, just ship the editor with all the code it needs to do its job.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#288

Post by TiredOfLife »

notnullorvoid wrote: post #229
TiredOfLife wrote: post #218

Earlier quoted context omitted.

Zed is even worse about arbitrarily downloading random stuff from random websites and executing it

How so? Part of what seemed good about Zed was that extensions have explicit permission controls.

2 years ago and still nothing has changed.

https://news.ycombinator.com/item?id=40902826

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#290

Post by srcoder »

Balinares wrote: post #277
camkego wrote: post #258

The security model, or almost lack of any whatsoever in VSCode drove me to only install MSFT extensions, then use Code Server in a docker container, but I decided I didn’t like using my editor in a browser. Finally I have decided to start using Zed, which isn’t perfect on the security front, but much better IMHO. The combination of WASM extensions, and the ability to put language servers, etc, in dev-containers seems…

Wait, how do you arrive at the thought that Zed is more secure? The one time I gave it a try, it tried to silently run npm -- yes, THIS[1] npm -- in the background without telling me, and I noped the heck out. Did I miss something? [1] https://www.reddit.com/r/programming/comments/1tapmvi/mass_n...

I don't have node running on my pc, I either put it in a container or i don't use it.

Software that is mostly an electron app. I start using my browser for a web edition, or run it in a container/sandbox!

Post reply on HN