Insane to think GH has at least 3800 internal repos.
well, own dogfood and all that, i'm not surprised?
GitHub confirms breach of 3,800 repos via malicious VSCode extension
291–300 of 488 posts
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#292Insane to think GH has at least 3800 internal repos.
Because it’s high or low? Imo it’s not that hard to reach that amount, they have quite a few employees, offering services for ~20 years and it’s probably also containing small repos - would’ve imagined way more tbh.
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#293Earlier quoted context omitted.
This is a continual fight for me. At nearly every company I've had to compromise on using a graveyard repo for packages within a monorepo, even though git has the whole history already.
The problem with history is that you need to know when to look. If you're looking for some old code that you know existed but you don't know exactly what it was, you can't just browse to go and find it.
Sure, but beyond a certain point the code that's there isn't just drop in compatible.
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#294Earlier quoted context omitted.
I've stayed with Sublime, often to the derision of VSCode addicts. I love to see the "VSCode is perfect" uncritical thinkers get theirs.
Sublime also has packages. https://packagecontrol.io Sublime's de facto package control repository is handled by an Uber engineer and father of 5 in his spare time, not someone currently at Sublime per https://packagecontrol.io/about / https://packagecontrol.io/say_thanks and his linked site. VS Code Marketplace seems to have a number of protections in place: https://code.visualstudio.com/docs/configure/extensions/ex…
I was feeling like sneering as well about how my emacs setup never caused any issues until I remembered emacs packages have zero protection whatsoever and can run anything anywhere, are ALL authored by some guy in Nebraska or Slovakia or something in their spare time :) but we don’t see any attacks since there’s so few of us still using emacs.
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#295Earlier quoted context omitted.
The problem extends far beyond VS code. All extensions and executable code has the same problem. There was a case where Disney was hacked because an employee installed a BeamNG mod that had bundled malware. A company that wants to remain secure would have to employ strict restrictions on installing software. Only installing npm packages and plugins from an internal preapproved repo for example.
Running code isn't the problem. The fact that (almost) all code runs at the same security level is. You regularly run tons of untrusted code when visiting websites. That code can't wreak havoc on your machine because it's well-sandboxed. Yet, if we advocate for sandboxing in more places, the "gun nuts of tech" scream about monopolistic practices and taking away user control.
As a "gun nut of tech", I have resolved this issue for myself with two computing categories for hardware I use: Hardware-I-trust and Hardware-someone-else-trusts. Sometimes these share information, and have to interact. Usually I am the one who decides how. Smartphones have never been in the category of "Hardware-I-Trust". For the first time in a long while my current employer paid for hardware is in that category for reasons of my own.
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#296Why does a company in GitHub's place allow employees to install random VSCode extensions?! That seems grossly irresponsible.
It's true. But at the same time, isn't it crazy to conclude that a company should restrict their developers from using their own developer productivity tools and services? If Microsoft devs shouldn't use random VSCode extensions, how could anyone?
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#297Earlier quoted context omitted.
I don’t understand why we don’t just sandbox everything. We have done it for web browsers, we can definitely do it for VSCode extensions.
Because it's hard to create a system that is both sandboxed and powerful. You can't have an extension system that allows a plugin to run a locally installed linter or view the status of docker containers but can't execute something malicious. I do agree though that it is incredibly important to start taking sandboxing seriously. But there is a lot of difficulty and friction, and most of the users will scream and cry…
I don’t know, we got rid of things like CGI and Java Applets for web but things are still useful enough
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#298I ditched VSCode for Sublime Text long back and don't feel missing anything. If any, my productivity and control over things has only improved.
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#299[flagged]
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#300Maybe I'm missing something really obvious, but... 3,800 repos? I guess I find it kind of surprising they have that many!
That was my first instinct, but thinking about it just a little it doesn't seem crazy, esp for GitHub.
How many folders do you have on your computer with some bits of code? It's probably not a terrible practice to add those folders to GitHub.
Across a big engineering company that can easily add up to way more than 3,800!