Live data from Hacker News

GitHub confirms breach of 3,800 repos via malicious VSCode extension

bleepingcomputer.com

301–310 of 488 posts

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#301
post #37

Earlier quoted context omitted.

I was part of an org with more than 15k repos

Damn that's alot. I'm wondering how many engineers handled all that?

I cannot share much details, but one thing: livegrep had no issues handling that many repos! That project is such a blessing

https://github.com/livegrep/livegrep

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#302
post #262

Earlier quoted context omitted.

You're assuming they allow it, but it might be against policy.

Fair point, I hadn't considered this, but wouldn't they just disallow it? Like, I use a VSCode fork at work, but the enforced extensions store backend is based on an allowlist and extensions need reviewing to be available there.

When I worked at Amazon, I had to run a special Amazon Linux. But I could just install whatever I wanted. I used emacs with whatever plugins I wanted.

Big tech can be suprisingly not locked down!

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#303
post #269
post #262

Earlier quoted context omitted.

You're assuming they allow it, but it might be against policy.

I’m pretty sure there is an policy on their internal wiki saying you shouldn’t do that. Problem is: most employees don’t care to read these. Although I’m sure something like this could have been checked for during commit.

They can enforce it with an MDM. Policy should be enforced where possible not just notified to people.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#307

Why does a company in GitHub's place allow employees to install random VSCode extensions?! That seems grossly irresponsible.

Because centralized management of resources is the death of innovation, intrinsic motivation and speed?

The dreaded "process" to get a single tool registered, working and allowed, is the reason a company is slow, dysfunctional and usually failing at a task.

The security tax and speeding tickets on everything are a luxury destroying much value.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#308

Earlier quoted context omitted.

How so? Part of what seemed good about Zed was that extensions have explicit permission controls.

2 years ago and still nothing has changed. https://news.ycombinator.com/item?id=40902826

That's a link to a hacker news post, which links to a reddit post, which links to https://github.com/zed-industries/zed/issues/12589 if anyone wants to go right to the 'open' issue.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#309

The security model, or almost lack of any whatsoever in VSCode drove me to only install MSFT extensions, then use Code Server in a docker container, but I decided I didn’t like using my editor in a browser. Finally I have decided to start using Zed, which isn’t perfect on the security front, but much better IMHO. The combination of WASM extensions, and the ability to put language servers, etc, in dev-containers seems…

> … use Code Server in a docker container …

I'm guessing you're referring to https://coder.com/docs/code-server ?

Post reply on HN